<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta name="generator" content="Asciidoctor 2.0.20">
<title>Logging Data Model Reference</title>
<link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Open+Sans:300,300italic,400,400italic,600,600italic%7CNoto+Serif:400,400italic,700,700italic%7CDroid+Sans+Mono:400,700">
<style>
/*! Asciidoctor default stylesheet | MIT License | https://asciidoctor.org */
/* Uncomment the following line when using as a custom stylesheet */
/* @import "https://fonts.googleapis.com/css?family=Open+Sans:300,300italic,400,400italic,600,600italic%7CNoto+Serif:400,400italic,700,700italic%7CDroid+Sans+Mono:400,700"; */
html{font-family:sans-serif;-webkit-text-size-adjust:100%}
a{background:none}
a:focus{outline:thin dotted}
a:active,a:hover{outline:0}
h1{font-size:2em;margin:.67em 0}
b,strong{font-weight:bold}
abbr{font-size:.9em}
abbr[title]{cursor:help;border-bottom:1px dotted #dddddf;text-decoration:none}
dfn{font-style:italic}
hr{height:0}
mark{background:#ff0;color:#000}
code,kbd,pre,samp{font-family:monospace;font-size:1em}
pre{white-space:pre-wrap}
q{quotes:"\201C" "\201D" "\2018" "\2019"}
small{font-size:80%}
sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}
sup{top:-.5em}
sub{bottom:-.25em}
img{border:0}
svg:not(:root){overflow:hidden}
figure{margin:0}
audio,video{display:inline-block}
audio:not([controls]){display:none;height:0}
fieldset{border:1px solid silver;margin:0 2px;padding:.35em .625em .75em}
legend{border:0;padding:0}
button,input,select,textarea{font-family:inherit;font-size:100%;margin:0}
button,input{line-height:normal}
button,select{text-transform:none}
button,html input[type=button],input[type=reset],input[type=submit]{-webkit-appearance:button;cursor:pointer}
button[disabled],html input[disabled]{cursor:default}
input[type=checkbox],input[type=radio]{padding:0}
button::-moz-focus-inner,input::-moz-focus-inner{border:0;padding:0}
textarea{overflow:auto;vertical-align:top}
table{border-collapse:collapse;border-spacing:0}
*,::before,::after{box-sizing:border-box}
html,body{font-size:100%}
body{background:#fff;color:rgba(0,0,0,.8);padding:0;margin:0;font-family:"Noto Serif","DejaVu Serif",serif;line-height:1;position:relative;cursor:auto;-moz-tab-size:4;-o-tab-size:4;tab-size:4;word-wrap:anywhere;-moz-osx-font-smoothing:grayscale;-webkit-font-smoothing:antialiased}
a:hover{cursor:pointer}
img,object,embed{max-width:100%;height:auto}
object,embed{height:100%}
img{-ms-interpolation-mode:bicubic}
.left{float:left!important}
.right{float:right!important}
.text-left{text-align:left!important}
.text-right{text-align:right!important}
.text-center{text-align:center!important}
.text-justify{text-align:justify!important}
.hide{display:none}
img,object,svg{display:inline-block;vertical-align:middle}
textarea{height:auto;min-height:50px}
select{width:100%}
.subheader,.admonitionblock td.content>.title,.audioblock>.title,.exampleblock>.title,.imageblock>.title,.listingblock>.title,.literalblock>.title,.stemblock>.title,.openblock>.title,.paragraph>.title,.quoteblock>.title,table.tableblock>.title,.verseblock>.title,.videoblock>.title,.dlist>.title,.olist>.title,.ulist>.title,.qlist>.title,.hdlist>.title{line-height:1.45;color:#7a2518;font-weight:400;margin-top:0;margin-bottom:.25em}
div,dl,dt,dd,ul,ol,li,h1,h2,h3,#toctitle,.sidebarblock>.content>.title,h4,h5,h6,pre,form,p,blockquote,th,td{margin:0;padding:0}
a{color:#2156a5;text-decoration:underline;line-height:inherit}
a:hover,a:focus{color:#1d4b8f}
a img{border:0}
p{line-height:1.6;margin-bottom:1.25em;text-rendering:optimizeLegibility}
p aside{font-size:.875em;line-height:1.35;font-style:italic}
h1,h2,h3,#toctitle,.sidebarblock>.content>.title,h4,h5,h6{font-family:"Open Sans","DejaVu Sans",sans-serif;font-weight:300;font-style:normal;color:#ba3925;text-rendering:optimizeLegibility;margin-top:1em;margin-bottom:.5em;line-height:1.0125em}
h1 small,h2 small,h3 small,#toctitle small,.sidebarblock>.content>.title small,h4 small,h5 small,h6 small{font-size:60%;color:#e99b8f;line-height:0}
h1{font-size:2.125em}
h2{font-size:1.6875em}
h3,#toctitle,.sidebarblock>.content>.title{font-size:1.375em}
h4,h5{font-size:1.125em}
h6{font-size:1em}
hr{border:solid #dddddf;border-width:1px 0 0;clear:both;margin:1.25em 0 1.1875em}
em,i{font-style:italic;line-height:inherit}
strong,b{font-weight:bold;line-height:inherit}
small{font-size:60%;line-height:inherit}
code{font-family:"Droid Sans Mono","DejaVu Sans Mono",monospace;font-weight:400;color:rgba(0,0,0,.9)}
ul,ol,dl{line-height:1.6;margin-bottom:1.25em;list-style-position:outside;font-family:inherit}
ul,ol{margin-left:1.5em}
ul li ul,ul li ol{margin-left:1.25em;margin-bottom:0}
ul.circle{list-style-type:circle}
ul.disc{list-style-type:disc}
ul.square{list-style-type:square}
ul.circle ul:not([class]),ul.disc ul:not([class]),ul.square ul:not([class]){list-style:inherit}
ol li ul,ol li ol{margin-left:1.25em;margin-bottom:0}
dl dt{margin-bottom:.3125em;font-weight:bold}
dl dd{margin-bottom:1.25em}
blockquote{margin:0 0 1.25em;padding:.5625em 1.25em 0 1.1875em;border-left:1px solid #ddd}
blockquote,blockquote p{line-height:1.6;color:rgba(0,0,0,.85)}
@media screen and (min-width:768px){h1,h2,h3,#toctitle,.sidebarblock>.content>.title,h4,h5,h6{line-height:1.2}
h1{font-size:2.75em}
h2{font-size:2.3125em}
h3,#toctitle,.sidebarblock>.content>.title{font-size:1.6875em}
h4{font-size:1.4375em}}
table{background:#fff;margin-bottom:1.25em;border:1px solid #dedede;word-wrap:normal}
table thead,table tfoot{background:#f7f8f7}
table thead tr th,table thead tr td,table tfoot tr th,table tfoot tr td{padding:.5em .625em .625em;font-size:inherit;color:rgba(0,0,0,.8);text-align:left}
table tr th,table tr td{padding:.5625em .625em;font-size:inherit;color:rgba(0,0,0,.8)}
table tr.even,table tr.alt{background:#f8f8f7}
table thead tr th,table tfoot tr th,table tbody tr td,table tr td,table tfoot tr td{line-height:1.6}
h1,h2,h3,#toctitle,.sidebarblock>.content>.title,h4,h5,h6{line-height:1.2;word-spacing:-.05em}
h1 strong,h2 strong,h3 strong,#toctitle strong,.sidebarblock>.content>.title strong,h4 strong,h5 strong,h6 strong{font-weight:400}
.center{margin-left:auto;margin-right:auto}
.stretch{width:100%}
.clearfix::before,.clearfix::after,.float-group::before,.float-group::after{content:" ";display:table}
.clearfix::after,.float-group::after{clear:both}
:not(pre).nobreak{word-wrap:normal}
:not(pre).nowrap{white-space:nowrap}
:not(pre).pre-wrap{white-space:pre-wrap}
:not(pre):not([class^=L])>code{font-size:.9375em;font-style:normal!important;letter-spacing:0;padding:.1em .5ex;word-spacing:-.15em;background:#f7f7f8;border-radius:4px;line-height:1.45;text-rendering:optimizeSpeed}
pre{color:rgba(0,0,0,.9);font-family:"Droid Sans Mono","DejaVu Sans Mono",monospace;line-height:1.45;text-rendering:optimizeSpeed}
pre code,pre pre{color:inherit;font-size:inherit;line-height:inherit}
pre>code{display:block}
pre.nowrap,pre.nowrap pre{white-space:pre;word-wrap:normal}
em em{font-style:normal}
strong strong{font-weight:400}
.keyseq{color:rgba(51,51,51,.8)}
kbd{font-family:"Droid Sans Mono","DejaVu Sans Mono",monospace;display:inline-block;color:rgba(0,0,0,.8);font-size:.65em;line-height:1.45;background:#f7f7f7;border:1px solid #ccc;border-radius:3px;box-shadow:0 1px 0 rgba(0,0,0,.2),inset 0 0 0 .1em #fff;margin:0 .15em;padding:.2em .5em;vertical-align:middle;position:relative;top:-.1em;white-space:nowrap}
.keyseq kbd:first-child{margin-left:0}
.keyseq kbd:last-child{margin-right:0}
.menuseq,.menuref{color:#000}
.menuseq b:not(.caret),.menuref{font-weight:inherit}
.menuseq{word-spacing:-.02em}
.menuseq b.caret{font-size:1.25em;line-height:.8}
.menuseq i.caret{font-weight:bold;text-align:center;width:.45em}
b.button::before,b.button::after{position:relative;top:-1px;font-weight:400}
b.button::before{content:"[";padding:0 3px 0 2px}
b.button::after{content:"]";padding:0 2px 0 3px}
p a>code:hover{color:rgba(0,0,0,.9)}
#header,#content,#footnotes,#footer{width:100%;margin:0 auto;max-width:62.5em;*zoom:1;position:relative;padding-left:.9375em;padding-right:.9375em}
#header::before,#header::after,#content::before,#content::after,#footnotes::before,#footnotes::after,#footer::before,#footer::after{content:" ";display:table}
#header::after,#content::after,#footnotes::after,#footer::after{clear:both}
#content{margin-top:1.25em}
#content::before{content:none}
#header>h1:first-child{color:rgba(0,0,0,.85);margin-top:2.25rem;margin-bottom:0}
#header>h1:first-child+#toc{margin-top:8px;border-top:1px solid #dddddf}
#header>h1:only-child,body.toc2 #header>h1:nth-last-child(2){border-bottom:1px solid #dddddf;padding-bottom:8px}
#header .details{border-bottom:1px solid #dddddf;line-height:1.45;padding-top:.25em;padding-bottom:.25em;padding-left:.25em;color:rgba(0,0,0,.6);display:flex;flex-flow:row wrap}
#header .details span:first-child{margin-left:-.125em}
#header .details span.email a{color:rgba(0,0,0,.85)}
#header .details br{display:none}
#header .details br+span::before{content:"\00a0\2013\00a0"}
#header .details br+span.author::before{content:"\00a0\22c5\00a0";color:rgba(0,0,0,.85)}
#header .details br+span#revremark::before{content:"\00a0|\00a0"}
#header #revnumber{text-transform:capitalize}
#header #revnumber::after{content:"\00a0"}
#content>h1:first-child:not([class]){color:rgba(0,0,0,.85);border-bottom:1px solid #dddddf;padding-bottom:8px;margin-top:0;padding-top:1rem;margin-bottom:1.25rem}
#toc{border-bottom:1px solid #e7e7e9;padding-bottom:.5em}
#toc>ul{margin-left:.125em}
#toc ul.sectlevel0>li>a{font-style:italic}
#toc ul.sectlevel0 ul.sectlevel1{margin:.5em 0}
#toc ul{font-family:"Open Sans","DejaVu Sans",sans-serif;list-style-type:none}
#toc li{line-height:1.3334;margin-top:.3334em}
#toc a{text-decoration:none}
#toc a:active{text-decoration:underline}
#toctitle{color:#7a2518;font-size:1.2em}
@media screen and (min-width:768px){#toctitle{font-size:1.375em}
body.toc2{padding-left:15em;padding-right:0}
#toc.toc2{margin-top:0!important;background:#f8f8f7;position:fixed;width:15em;left:0;top:0;border-right:1px solid #e7e7e9;border-top-width:0!important;border-bottom-width:0!important;z-index:1000;padding:1.25em 1em;height:100%;overflow:auto}
#toc.toc2 #toctitle{margin-top:0;margin-bottom:.8rem;font-size:1.2em}
#toc.toc2>ul{font-size:.9em;margin-bottom:0}
#toc.toc2 ul ul{margin-left:0;padding-left:1em}
#toc.toc2 ul.sectlevel0 ul.sectlevel1{padding-left:0;margin-top:.5em;margin-bottom:.5em}
body.toc2.toc-right{padding-left:0;padding-right:15em}
body.toc2.toc-right #toc.toc2{border-right-width:0;border-left:1px solid #e7e7e9;left:auto;right:0}}
@media screen and (min-width:1280px){body.toc2{padding-left:20em;padding-right:0}
#toc.toc2{width:20em}
#toc.toc2 #toctitle{font-size:1.375em}
#toc.toc2>ul{font-size:.95em}
#toc.toc2 ul ul{padding-left:1.25em}
body.toc2.toc-right{padding-left:0;padding-right:20em}}
#content #toc{border:1px solid #e0e0dc;margin-bottom:1.25em;padding:1.25em;background:#f8f8f7;border-radius:4px}
#content #toc>:first-child{margin-top:0}
#content #toc>:last-child{margin-bottom:0}
#footer{max-width:none;background:rgba(0,0,0,.8);padding:1.25em}
#footer-text{color:hsla(0,0%,100%,.8);line-height:1.44}
#content{margin-bottom:.625em}
.sect1{padding-bottom:.625em}
@media screen and (min-width:768px){#content{margin-bottom:1.25em}
.sect1{padding-bottom:1.25em}}
.sect1:last-child{padding-bottom:0}
.sect1+.sect1{border-top:1px solid #e7e7e9}
#content h1>a.anchor,h2>a.anchor,h3>a.anchor,#toctitle>a.anchor,.sidebarblock>.content>.title>a.anchor,h4>a.anchor,h5>a.anchor,h6>a.anchor{position:absolute;z-index:1001;width:1.5ex;margin-left:-1.5ex;display:block;text-decoration:none!important;visibility:hidden;text-align:center;font-weight:400}
#content h1>a.anchor::before,h2>a.anchor::before,h3>a.anchor::before,#toctitle>a.anchor::before,.sidebarblock>.content>.title>a.anchor::before,h4>a.anchor::before,h5>a.anchor::before,h6>a.anchor::before{content:"\00A7";font-size:.85em;display:block;padding-top:.1em}
#content h1:hover>a.anchor,#content h1>a.anchor:hover,h2:hover>a.anchor,h2>a.anchor:hover,h3:hover>a.anchor,#toctitle:hover>a.anchor,.sidebarblock>.content>.title:hover>a.anchor,h3>a.anchor:hover,#toctitle>a.anchor:hover,.sidebarblock>.content>.title>a.anchor:hover,h4:hover>a.anchor,h4>a.anchor:hover,h5:hover>a.anchor,h5>a.anchor:hover,h6:hover>a.anchor,h6>a.anchor:hover{visibility:visible}
#content h1>a.link,h2>a.link,h3>a.link,#toctitle>a.link,.sidebarblock>.content>.title>a.link,h4>a.link,h5>a.link,h6>a.link{color:#ba3925;text-decoration:none}
#content h1>a.link:hover,h2>a.link:hover,h3>a.link:hover,#toctitle>a.link:hover,.sidebarblock>.content>.title>a.link:hover,h4>a.link:hover,h5>a.link:hover,h6>a.link:hover{color:#a53221}
details,.audioblock,.imageblock,.literalblock,.listingblock,.stemblock,.videoblock{margin-bottom:1.25em}
details{margin-left:1.25rem}
details>summary{cursor:pointer;display:block;position:relative;line-height:1.6;margin-bottom:.625rem;outline:none;-webkit-tap-highlight-color:transparent}
details>summary::-webkit-details-marker{display:none}
details>summary::before{content:"";border:solid transparent;border-left:solid;border-width:.3em 0 .3em .5em;position:absolute;top:.5em;left:-1.25rem;transform:translateX(15%)}
details[open]>summary::before{border:solid transparent;border-top:solid;border-width:.5em .3em 0;transform:translateY(15%)}
details>summary::after{content:"";width:1.25rem;height:1em;position:absolute;top:.3em;left:-1.25rem}
.admonitionblock td.content>.title,.audioblock>.title,.exampleblock>.title,.imageblock>.title,.listingblock>.title,.literalblock>.title,.stemblock>.title,.openblock>.title,.paragraph>.title,.quoteblock>.title,table.tableblock>.title,.verseblock>.title,.videoblock>.title,.dlist>.title,.olist>.title,.ulist>.title,.qlist>.title,.hdlist>.title{text-rendering:optimizeLegibility;text-align:left;font-family:"Noto Serif","DejaVu Serif",serif;font-size:1rem;font-style:italic}
table.tableblock.fit-content>caption.title{white-space:nowrap;width:0}
.paragraph.lead>p,#preamble>.sectionbody>[class=paragraph]:first-of-type p{font-size:1.21875em;line-height:1.6;color:rgba(0,0,0,.85)}
.admonitionblock>table{border-collapse:separate;border:0;background:none;width:100%}
.admonitionblock>table td.icon{text-align:center;width:80px}
.admonitionblock>table td.icon img{max-width:none}
.admonitionblock>table td.icon .title{font-weight:bold;font-family:"Open Sans","DejaVu Sans",sans-serif;text-transform:uppercase}
.admonitionblock>table td.content{padding-left:1.125em;padding-right:1.25em;border-left:1px solid #dddddf;color:rgba(0,0,0,.6);word-wrap:anywhere}
.admonitionblock>table td.content>:last-child>:last-child{margin-bottom:0}
.exampleblock>.content{border:1px solid #e6e6e6;margin-bottom:1.25em;padding:1.25em;background:#fff;border-radius:4px}
.sidebarblock{border:1px solid #dbdbd6;margin-bottom:1.25em;padding:1.25em;background:#f3f3f2;border-radius:4px}
.sidebarblock>.content>.title{color:#7a2518;margin-top:0;text-align:center}
.exampleblock>.content>:first-child,.sidebarblock>.content>:first-child{margin-top:0}
.exampleblock>.content>:last-child,.exampleblock>.content>:last-child>:last-child,.exampleblock>.content .olist>ol>li:last-child>:last-child,.exampleblock>.content .ulist>ul>li:last-child>:last-child,.exampleblock>.content .qlist>ol>li:last-child>:last-child,.sidebarblock>.content>:last-child,.sidebarblock>.content>:last-child>:last-child,.sidebarblock>.content .olist>ol>li:last-child>:last-child,.sidebarblock>.content .ulist>ul>li:last-child>:last-child,.sidebarblock>.content .qlist>ol>li:last-child>:last-child{margin-bottom:0}
.literalblock pre,.listingblock>.content>pre{border-radius:4px;overflow-x:auto;padding:1em;font-size:.8125em}
@media screen and (min-width:768px){.literalblock pre,.listingblock>.content>pre{font-size:.90625em}}
@media screen and (min-width:1280px){.literalblock pre,.listingblock>.content>pre{font-size:1em}}
.literalblock pre,.listingblock>.content>pre:not(.highlight),.listingblock>.content>pre[class=highlight],.listingblock>.content>pre[class^="highlight "]{background:#f7f7f8}
.literalblock.output pre{color:#f7f7f8;background:rgba(0,0,0,.9)}
.listingblock>.content{position:relative}
.listingblock code[data-lang]::before{display:none;content:attr(data-lang);position:absolute;font-size:.75em;top:.425rem;right:.5rem;line-height:1;text-transform:uppercase;color:inherit;opacity:.5}
.listingblock:hover code[data-lang]::before{display:block}
.listingblock.terminal pre .command::before{content:attr(data-prompt);padding-right:.5em;color:inherit;opacity:.5}
.listingblock.terminal pre .command:not([data-prompt])::before{content:"$"}
.listingblock pre.highlightjs{padding:0}
.listingblock pre.highlightjs>code{padding:1em;border-radius:4px}
.listingblock pre.prettyprint{border-width:0}
.prettyprint{background:#f7f7f8}
pre.prettyprint .linenums{line-height:1.45;margin-left:2em}
pre.prettyprint li{background:none;list-style-type:inherit;padding-left:0}
pre.prettyprint li code[data-lang]::before{opacity:1}
pre.prettyprint li:not(:first-child) code[data-lang]::before{display:none}
table.linenotable{border-collapse:separate;border:0;margin-bottom:0;background:none}
table.linenotable td[class]{color:inherit;vertical-align:top;padding:0;line-height:inherit;white-space:normal}
table.linenotable td.code{padding-left:.75em}
table.linenotable td.linenos,pre.pygments .linenos{border-right:1px solid;opacity:.35;padding-right:.5em;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none;user-select:none}
pre.pygments span.linenos{display:inline-block;margin-right:.75em}
.quoteblock{margin:0 1em 1.25em 1.5em;display:table}
.quoteblock:not(.excerpt)>.title{margin-left:-1.5em;margin-bottom:.75em}
.quoteblock blockquote,.quoteblock p{color:rgba(0,0,0,.85);font-size:1.15rem;line-height:1.75;word-spacing:.1em;letter-spacing:0;font-style:italic;text-align:justify}
.quoteblock blockquote{margin:0;padding:0;border:0}
.quoteblock blockquote::before{content:"\201c";float:left;font-size:2.75em;font-weight:bold;line-height:.6em;margin-left:-.6em;color:#7a2518;text-shadow:0 1px 2px rgba(0,0,0,.1)}
.quoteblock blockquote>.paragraph:last-child p{margin-bottom:0}
.quoteblock .attribution{margin-top:.75em;margin-right:.5ex;text-align:right}
.verseblock{margin:0 1em 1.25em}
.verseblock pre{font-family:"Open Sans","DejaVu Sans",sans-serif;font-size:1.15rem;color:rgba(0,0,0,.85);font-weight:300;text-rendering:optimizeLegibility}
.verseblock pre strong{font-weight:400}
.verseblock .attribution{margin-top:1.25rem;margin-left:.5ex}
.quoteblock .attribution,.verseblock .attribution{font-size:.9375em;line-height:1.45;font-style:italic}
.quoteblock .attribution br,.verseblock .attribution br{display:none}
.quoteblock .attribution cite,.verseblock .attribution cite{display:block;letter-spacing:-.025em;color:rgba(0,0,0,.6)}
.quoteblock.abstract blockquote::before,.quoteblock.excerpt blockquote::before,.quoteblock .quoteblock blockquote::before{display:none}
.quoteblock.abstract blockquote,.quoteblock.abstract p,.quoteblock.excerpt blockquote,.quoteblock.excerpt p,.quoteblock .quoteblock blockquote,.quoteblock .quoteblock p{line-height:1.6;word-spacing:0}
.quoteblock.abstract{margin:0 1em 1.25em;display:block}
.quoteblock.abstract>.title{margin:0 0 .375em;font-size:1.15em;text-align:center}
.quoteblock.excerpt>blockquote,.quoteblock .quoteblock{padding:0 0 .25em 1em;border-left:.25em solid #dddddf}
.quoteblock.excerpt,.quoteblock .quoteblock{margin-left:0}
.quoteblock.excerpt blockquote,.quoteblock.excerpt p,.quoteblock .quoteblock blockquote,.quoteblock .quoteblock p{color:inherit;font-size:1.0625rem}
.quoteblock.excerpt .attribution,.quoteblock .quoteblock .attribution{color:inherit;font-size:.85rem;text-align:left;margin-right:0}
p.tableblock:last-child{margin-bottom:0}
td.tableblock>.content{margin-bottom:1.25em;word-wrap:anywhere}
td.tableblock>.content>:last-child{margin-bottom:-1.25em}
table.tableblock,th.tableblock,td.tableblock{border:0 solid #dedede}
table.grid-all>*>tr>*{border-width:1px}
table.grid-cols>*>tr>*{border-width:0 1px}
table.grid-rows>*>tr>*{border-width:1px 0}
table.frame-all{border-width:1px}
table.frame-ends{border-width:1px 0}
table.frame-sides{border-width:0 1px}
table.frame-none>colgroup+*>:first-child>*,table.frame-sides>colgroup+*>:first-child>*{border-top-width:0}
table.frame-none>:last-child>:last-child>*,table.frame-sides>:last-child>:last-child>*{border-bottom-width:0}
table.frame-none>*>tr>:first-child,table.frame-ends>*>tr>:first-child{border-left-width:0}
table.frame-none>*>tr>:last-child,table.frame-ends>*>tr>:last-child{border-right-width:0}
table.stripes-all>*>tr,table.stripes-odd>*>tr:nth-of-type(odd),table.stripes-even>*>tr:nth-of-type(even),table.stripes-hover>*>tr:hover{background:#f8f8f7}
th.halign-left,td.halign-left{text-align:left}
th.halign-right,td.halign-right{text-align:right}
th.halign-center,td.halign-center{text-align:center}
th.valign-top,td.valign-top{vertical-align:top}
th.valign-bottom,td.valign-bottom{vertical-align:bottom}
th.valign-middle,td.valign-middle{vertical-align:middle}
table thead th,table tfoot th{font-weight:bold}
tbody tr th{background:#f7f8f7}
tbody tr th,tbody tr th p,tfoot tr th,tfoot tr th p{color:rgba(0,0,0,.8);font-weight:bold}
p.tableblock>code:only-child{background:none;padding:0}
p.tableblock{font-size:1em}
ol{margin-left:1.75em}
ul li ol{margin-left:1.5em}
dl dd{margin-left:1.125em}
dl dd:last-child,dl dd:last-child>:last-child{margin-bottom:0}
li p,ul dd,ol dd,.olist .olist,.ulist .ulist,.ulist .olist,.olist .ulist{margin-bottom:.625em}
ul.checklist,ul.none,ol.none,ul.no-bullet,ol.no-bullet,ol.unnumbered,ul.unstyled,ol.unstyled{list-style-type:none}
ul.no-bullet,ol.no-bullet,ol.unnumbered{margin-left:.625em}
ul.unstyled,ol.unstyled{margin-left:0}
li>p:empty:only-child::before{content:"";display:inline-block}
ul.checklist>li>p:first-child{margin-left:-1em}
ul.checklist>li>p:first-child>.fa-square-o:first-child,ul.checklist>li>p:first-child>.fa-check-square-o:first-child{width:1.25em;font-size:.8em;position:relative;bottom:.125em}
ul.checklist>li>p:first-child>input[type=checkbox]:first-child{margin-right:.25em}
ul.inline{display:flex;flex-flow:row wrap;list-style:none;margin:0 0 .625em -1.25em}
ul.inline>li{margin-left:1.25em}
.unstyled dl dt{font-weight:400;font-style:normal}
ol.arabic{list-style-type:decimal}
ol.decimal{list-style-type:decimal-leading-zero}
ol.loweralpha{list-style-type:lower-alpha}
ol.upperalpha{list-style-type:upper-alpha}
ol.lowerroman{list-style-type:lower-roman}
ol.upperroman{list-style-type:upper-roman}
ol.lowergreek{list-style-type:lower-greek}
.hdlist>table,.colist>table{border:0;background:none}
.hdlist>table>tbody>tr,.colist>table>tbody>tr{background:none}
td.hdlist1,td.hdlist2{vertical-align:top;padding:0 .625em}
td.hdlist1{font-weight:bold;padding-bottom:1.25em}
td.hdlist2{word-wrap:anywhere}
.literalblock+.colist,.listingblock+.colist{margin-top:-.5em}
.colist td:not([class]):first-child{padding:.4em .75em 0;line-height:1;vertical-align:top}
.colist td:not([class]):first-child img{max-width:none}
.colist td:not([class]):last-child{padding:.25em 0}
.thumb,.th{line-height:0;display:inline-block;border:4px solid #fff;box-shadow:0 0 0 1px #ddd}
.imageblock.left{margin:.25em .625em 1.25em 0}
.imageblock.right{margin:.25em 0 1.25em .625em}
.imageblock>.title{margin-bottom:0}
.imageblock.thumb,.imageblock.th{border-width:6px}
.imageblock.thumb>.title,.imageblock.th>.title{padding:0 .125em}
.image.left,.image.right{margin-top:.25em;margin-bottom:.25em;display:inline-block;line-height:0}
.image.left{margin-right:.625em}
.image.right{margin-left:.625em}
a.image{text-decoration:none;display:inline-block}
a.image object{pointer-events:none}
sup.footnote,sup.footnoteref{font-size:.875em;position:static;vertical-align:super}
sup.footnote a,sup.footnoteref a{text-decoration:none}
sup.footnote a:active,sup.footnoteref a:active{text-decoration:underline}
#footnotes{padding-top:.75em;padding-bottom:.75em;margin-bottom:.625em}
#footnotes hr{width:20%;min-width:6.25em;margin:-.25em 0 .75em;border-width:1px 0 0}
#footnotes .footnote{padding:0 .375em 0 .225em;line-height:1.3334;font-size:.875em;margin-left:1.2em;margin-bottom:.2em}
#footnotes .footnote a:first-of-type{font-weight:bold;text-decoration:none;margin-left:-1.05em}
#footnotes .footnote:last-of-type{margin-bottom:0}
#content #footnotes{margin-top:-.625em;margin-bottom:0;padding:.75em 0}
div.unbreakable{page-break-inside:avoid}
.big{font-size:larger}
.small{font-size:smaller}
.underline{text-decoration:underline}
.overline{text-decoration:overline}
.line-through{text-decoration:line-through}
.aqua{color:#00bfbf}
.aqua-background{background:#00fafa}
.black{color:#000}
.black-background{background:#000}
.blue{color:#0000bf}
.blue-background{background:#0000fa}
.fuchsia{color:#bf00bf}
.fuchsia-background{background:#fa00fa}
.gray{color:#606060}
.gray-background{background:#7d7d7d}
.green{color:#006000}
.green-background{background:#007d00}
.lime{color:#00bf00}
.lime-background{background:#00fa00}
.maroon{color:#600000}
.maroon-background{background:#7d0000}
.navy{color:#000060}
.navy-background{background:#00007d}
.olive{color:#606000}
.olive-background{background:#7d7d00}
.purple{color:#600060}
.purple-background{background:#7d007d}
.red{color:#bf0000}
.red-background{background:#fa0000}
.silver{color:#909090}
.silver-background{background:#bcbcbc}
.teal{color:#006060}
.teal-background{background:#007d7d}
.white{color:#bfbfbf}
.white-background{background:#fafafa}
.yellow{color:#bfbf00}
.yellow-background{background:#fafa00}
span.icon>.fa{cursor:default}
a span.icon>.fa{cursor:inherit}
.admonitionblock td.icon [class^="fa icon-"]{font-size:2.5em;text-shadow:1px 1px 2px rgba(0,0,0,.5);cursor:default}
.admonitionblock td.icon .icon-note::before{content:"\f05a";color:#19407c}
.admonitionblock td.icon .icon-tip::before{content:"\f0eb";text-shadow:1px 1px 2px rgba(155,155,0,.8);color:#111}
.admonitionblock td.icon .icon-warning::before{content:"\f071";color:#bf6900}
.admonitionblock td.icon .icon-caution::before{content:"\f06d";color:#bf3400}
.admonitionblock td.icon .icon-important::before{content:"\f06a";color:#bf0000}
.conum[data-value]{display:inline-block;color:#fff!important;background:rgba(0,0,0,.8);border-radius:50%;text-align:center;font-size:.75em;width:1.67em;height:1.67em;line-height:1.67em;font-family:"Open Sans","DejaVu Sans",sans-serif;font-style:normal;font-weight:bold}
.conum[data-value] *{color:#fff!important}
.conum[data-value]+b{display:none}
.conum[data-value]::after{content:attr(data-value)}
pre .conum[data-value]{position:relative;top:-.125em}
b.conum *{color:inherit!important}
.conum:not([data-value]):empty{display:none}
dt,th.tableblock,td.content,div.footnote{text-rendering:optimizeLegibility}
h1,h2,p,td.content,span.alt,summary{letter-spacing:-.01em}
p strong,td.content strong,div.footnote strong{letter-spacing:-.005em}
p,blockquote,dt,td.content,td.hdlist1,span.alt,summary{font-size:1.0625rem}
p{margin-bottom:1.25rem}
.sidebarblock p,.sidebarblock dt,.sidebarblock td.content,p.tableblock{font-size:1em}
.exampleblock>.content{background:#fffef7;border-color:#e0e0dc;box-shadow:0 1px 4px #e0e0dc}
.print-only{display:none!important}
@page{margin:1.25cm .75cm}
@media print{*{box-shadow:none!important;text-shadow:none!important}
html{font-size:80%}
a{color:inherit!important;text-decoration:underline!important}
a.bare,a[href^="#"],a[href^="mailto:"]{text-decoration:none!important}
a[href^="http:"]:not(.bare)::after,a[href^="https:"]:not(.bare)::after{content:"(" attr(href) ")";display:inline-block;font-size:.875em;padding-left:.25em}
abbr[title]{border-bottom:1px dotted}
abbr[title]::after{content:" (" attr(title) ")"}
pre,blockquote,tr,img,object,svg{page-break-inside:avoid}
thead{display:table-header-group}
svg{max-width:100%}
p,blockquote,dt,td.content{font-size:1em;orphans:3;widows:3}
h2,h3,#toctitle,.sidebarblock>.content>.title{page-break-after:avoid}
#header,#content,#footnotes,#footer{max-width:none}
#toc,.sidebarblock,.exampleblock>.content{background:none!important}
#toc{border-bottom:1px solid #dddddf!important;padding-bottom:0!important}
body.book #header{text-align:center}
body.book #header>h1:first-child{border:0!important;margin:2.5em 0 1em}
body.book #header .details{border:0!important;display:block;padding:0!important}
body.book #header .details span:first-child{margin-left:0!important}
body.book #header .details br{display:block}
body.book #header .details br+span::before{content:none!important}
body.book #toc{border:0!important;text-align:left!important;padding:0!important;margin:0!important}
body.book #toc,body.book #preamble,body.book h1.sect0,body.book .sect1>h2{page-break-before:always}
.listingblock code[data-lang]::before{display:block}
#footer{padding:0 .9375em}
.hide-on-print{display:none!important}
.print-only{display:block!important}
.hide-for-print{display:none!important}
.show-for-print{display:inherit!important}}
@media amzn-kf8,print{#header>h1:first-child{margin-top:1.25rem}
.sect1{padding:0!important}
.sect1+.sect1{border:0}
#footer{background:none}
#footer-text{color:rgba(0,0,0,.6);font-size:.9em}}
@media amzn-kf8{#header,#content,#footnotes,#footer{padding:0}}
</style>
</head>
<body class="article">
<div id="header">
<h1>Logging Data Model Reference</h1>
</div>
<div id="content">
<h1 id="_package_viaqv1" class="sect0">Package viaq/v1</h1>
<div class="sect1">
<h2 id="_viaq_data_model_for_kubernetes_api_events">Viaq Data Model for kubernetes api events</h2>
<div class="sectionbody">
<div class="paragraph">
<p>The data model for collected audit event logs from kubernetes or OpenShift api servers.</p>
</div>
<div class="paragraph">
<p>nolint:govet</p>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">involvedObject</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The object that this event is about.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">reason</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> This should be a short, machine understandable string that gives the reason</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">message</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> A human-readable description of the status of this operation.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">source</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> The component reporting this event. Should be a short machine understandable string.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">firstTimestamp</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> The time at which the event was first recorded. (Time of server receipt is in TypeMeta.)</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">lastTimestamp</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> The time at which the most recent occurrence of this event was recorded.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">count</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">int</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> The number of times this event has occurred.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">type</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Type of this event (Normal, Warning), new types could be added in the future</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">eventTime</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Time when this Event was first observed.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">series</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Data about the Event series this event represents or nil if it&#39;s a singleton Event.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">action</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> What action was taken/failed regarding to the Regarding object.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">related</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Optional secondary object for more complex actions.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">reportingComponent</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Name of the controller that emitted this Event, e.g. <code>kubernetes.io/kubelet</code>.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">reportingInstance</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> ID of the controller instance, e.g. <code>kubelet-xyzf</code>.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">@timestamp</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>A UTC value that marks when the log payload was created.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">message</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Original log entry text, UTF-8 encoded</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">level</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The normalized log level</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">hostname</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The name of the host where this log message originated. In a Kubernetes cluster, this is the same as <code>kubernetes.host</code>.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">pipeline_metadata</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(DEPRECATED)</strong> <strong>(optional)</strong> Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">log_type</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The source type of the log. The <code>log_type</code> field may contain one of these strings, or may have additional dot-separated components, for example &#34;infrastructure.container&#34; or &#34;infrastructure.node&#34;.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">viaq_index_name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> ViaqIndexName used with Elasticsearch 6.x and later, this is a name of a write index alias (e.g. app-write).</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">viaq_msg_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> ViaqMessageId is a unique ID assigned to each message. The format is not specified.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">openshift</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Openshift specific metadata</p>
</div></div></td>
</tr>
</tbody>
</table>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">action</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> What action was taken/failed regarding to the Regarding object.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">count</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">int</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> The number of times this event has occurred.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">eventTime</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Time when this Event was first observed.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">firstTimestamp</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> The time at which the event was first recorded. (Time of server receipt is in TypeMeta.)</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">involvedObject</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The object that this event is about.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">lastTimestamp</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> The time at which the most recent occurrence of this event was recorded.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">message</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> A human-readable description of the status of this operation.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">reason</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> This should be a short, machine understandable string that gives the reason</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">related</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Optional secondary object for more complex actions.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">reportingComponent</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Name of the controller that emitted this Event, e.g. <code>kubernetes.io/kubelet</code>.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">reportingInstance</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> ID of the controller instance, e.g. <code>kubelet-xyzf</code>.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">series</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Data about the Event series this event represents or nil if it&#39;s a singleton Event.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">source</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> The component reporting this event. Should be a short machine understandable string.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">type</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Type of this event (Normal, Warning), new types could be added in the future</p>
</div></div></td>
</tr>
</tbody>
</table>
<div class="sect2">
<h3 id="_action">.action</h3>
<div class="sect4">
<h5 id="_description">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> What action was taken/failed regarding to the Regarding object.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_count">.count</h3>
<div class="sect4">
<h5 id="_description_2">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> The number of times this event has occurred.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_2">Type</h5>
<div class="ulist">
<ul>
<li>
<p>int</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_eventtime">.eventTime</h3>
<div class="sect4">
<h5 id="_description_3">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Time when this Event was first observed.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_3">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">Time</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_eventtime_time">.eventTime.Time</h3>
<div class="sect4">
<h5 id="_description_4">Description</h5>

</div>
<div class="sect4">
<h5 id="_type_4">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_firsttimestamp">.firstTimestamp</h3>
<div class="sect4">
<h5 id="_description_5">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> The time at which the event was first recorded. (Time of server receipt is in TypeMeta.)</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_5">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_involvedobject">.involvedObject</h3>
<div class="sect4">
<h5 id="_description_6">Description</h5>
<div class="paragraph">
<p>The object that this event is about.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_6">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">apiVersion</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> API version of the referent.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">fieldPath</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> If referring to a piece of an object instead of an entire object, this string</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">kind</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Kind of the referent.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Name of the referent.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">namespace</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Namespace of the referent.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">resourceVersion</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Specific resourceVersion to which this reference is made, if any.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">uid</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> UID of the referent.</p>
</div></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_involvedobject_apiversion">.involvedObject.apiVersion</h3>
<div class="sect4">
<h5 id="_description_7">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> API version of the referent.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_7">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_involvedobject_fieldpath">.involvedObject.fieldPath</h3>
<div class="sect4">
<h5 id="_description_8">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> If referring to a piece of an object instead of an entire object, this string
should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
For example, if the object reference is to a container within a pod, this would take on a value like:
&#34;spec.containers{name}&#34; (where &#34;name&#34; refers to the name of the container that triggered
the event) or if no container name is specified &#34;spec.containers[2]&#34; (container with
index 2 in this pod). This syntax is chosen only to have some well-defined way of
referencing a part of an object.
TODO: this design is not final and this field is subject to change in the future.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_8">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_involvedobject_kind">.involvedObject.kind</h3>
<div class="sect4">
<h5 id="_description_9">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Kind of the referent.
More info: <a href="https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" class="bare">https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds</a></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_9">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_involvedobject_name">.involvedObject.name</h3>
<div class="sect4">
<h5 id="_description_10">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Name of the referent.
More info: <a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names" class="bare">https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names</a></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_10">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_involvedobject_namespace">.involvedObject.namespace</h3>
<div class="sect4">
<h5 id="_description_11">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Namespace of the referent.
More info: <a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/" class="bare">https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/</a></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_11">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_involvedobject_resourceversion">.involvedObject.resourceVersion</h3>
<div class="sect4">
<h5 id="_description_12">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Specific resourceVersion to which this reference is made, if any.
More info: <a href="https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency" class="bare">https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency</a></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_12">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_involvedobject_uid">.involvedObject.uid</h3>
<div class="sect4">
<h5 id="_description_13">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> UID of the referent.
More info: <a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids" class="bare">https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids</a></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_13">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_lasttimestamp">.lastTimestamp</h3>
<div class="sect4">
<h5 id="_description_14">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> The time at which the most recent occurrence of this event was recorded.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_14">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_message">.message</h3>
<div class="sect4">
<h5 id="_description_15">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> A human-readable description of the status of this operation.
TODO: decide on maximum length.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_15">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_reason">.reason</h3>
<div class="sect4">
<h5 id="_description_16">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> This should be a short, machine understandable string that gives the reason
for the transition into the object&#39;s current status.
TODO: provide exact specification for format.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_16">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_related">.related</h3>
<div class="sect4">
<h5 id="_description_17">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Optional secondary object for more complex actions.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_17">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_reportingcomponent">.reportingComponent</h3>
<div class="sect4">
<h5 id="_description_18">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Name of the controller that emitted this Event, e.g. <code>kubernetes.io/kubelet</code>.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_18">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_reportinginstance">.reportingInstance</h3>
<div class="sect4">
<h5 id="_description_19">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> ID of the controller instance, e.g. <code>kubelet-xyzf</code>.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_19">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_series">.series</h3>
<div class="sect4">
<h5 id="_description_20">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Data about the Event series this event represents or nil if it&#39;s a singleton Event.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_20">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_source">.source</h3>
<div class="sect4">
<h5 id="_description_21">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> The component reporting this event. Should be a short machine understandable string.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_21">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">component</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Component from which the event is generated.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">host</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Node name on which the event is generated.</p>
</div></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_source_component">.source.component</h3>
<div class="sect4">
<h5 id="_description_22">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Component from which the event is generated.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_22">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_source_host">.source.host</h3>
<div class="sect4">
<h5 id="_description_23">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Node name on which the event is generated.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_23">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_type_24">.type</h3>
<div class="sect4">
<h5 id="_description_24">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Type of this event (Normal, Warning), new types could be added in the future</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_25">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">@timestamp</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>A UTC value that marks when the log payload was created.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">hostname</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The name of the host where this log message originated. In a Kubernetes cluster, this is the same as <code>kubernetes.host</code>.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">level</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The normalized log level</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">log_type</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The source type of the log. The <code>log_type</code> field may contain one of these strings, or may have additional dot-separated components, for example &#34;infrastructure.container&#34; or &#34;infrastructure.node&#34;.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">message</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Original log entry text, UTF-8 encoded</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">openshift</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Openshift specific metadata</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">pipeline_metadata</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(DEPRECATED)</strong> <strong>(optional)</strong> Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">viaq_index_name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> ViaqIndexName used with Elasticsearch 6.x and later, this is a name of a write index alias (e.g. app-write).</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">viaq_msg_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> ViaqMessageId is a unique ID assigned to each message. The format is not specified.</p>
</div></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_timestamp">.@timestamp</h3>
<div class="sect4">
<h5 id="_description_25">Description</h5>
<div class="paragraph">
<p>A UTC value that marks when the log payload was created.</p>
</div>
<div class="paragraph">
<p>If the creation time is not known when the log payload was first collected. The “@” prefix denotes a
field that is reserved for a particular use.</p>
</div>
<div class="paragraph">
<p>format:</p>
</div>
<div class="ulist">
<ul>
<li>
<p>yyyy-MM-dd HH:mm:ss,SSSZ</p>
</li>
<li>
<p>yyyy-MM-dd&#39;T&#39;HH:mm:ss.SSSSSSZ</p>
</li>
<li>
<p>yyyy-MM-dd&#39;T&#39;HH:mm:ssZ</p>
</li>
<li>
<p>dateOptionalTime</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>example: <code>2015-01-24 14:06:05.071000000 Z</code></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_26">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_hostname">.hostname</h3>
<div class="sect4">
<h5 id="_description_26">Description</h5>
<div class="paragraph">
<p>The name of the host where this log message originated. In a Kubernetes cluster, this is the same as <code>kubernetes.host</code>.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_27">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_level">.level</h3>
<div class="sect4">
<h5 id="_description_27">Description</h5>
<div class="paragraph">
<p>The normalized log level</p>
</div>
<div class="paragraph">
<p>The logging level from various sources, including <code>rsyslog(severitytext property)</code>, python&#39;s logging module, and others.</p>
</div>
<div class="paragraph">
<p>The following values come from <a href="http://sourceware.org/git/?p=glibc.git;a=blob;f=misc/sys/syslog.h;h=ee01478c4b19a954426a96448577c5a76e6647c0;hb=HEAD#l74"><code>syslog.h</code></a>, and are preceded by their <a href="http://sourceware.org/git/?p=glibc.git;a=blob;f=misc/sys/syslog.h;h=ee01478c4b19a954426a96448577c5a76e6647c0;hb=HEAD#l51">numeric equivalents</a>:</p>
</div>
<div class="ulist">
<ul>
<li>
<p><code>0</code> = <code>emerg</code>, system is unusable.</p>
</li>
<li>
<p><code>1</code> = <code>alert</code>, action must be taken immediately.</p>
</li>
<li>
<p><code>2</code> = <code>crit</code>, critical conditions.</p>
</li>
<li>
<p><code>3</code> = <code>err</code>, error conditions.</p>
</li>
<li>
<p><code>4</code> = <code>warn</code>, warning conditions.</p>
</li>
<li>
<p><code>5</code> = <code>notice</code>, normal but significant condition.</p>
</li>
<li>
<p><code>6</code> = <code>info</code>, informational.</p>
</li>
<li>
<p><code>7</code> = <code>debug</code>, debug-level messages.</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>The two following values are not part of <code>syslog.h</code> but are widely used:</p>
</div>
<div class="ulist">
<ul>
<li>
<p><code>8</code> = <code>trace</code>, trace-level messages, which are more verbose than <code>debug</code> messages.</p>
</li>
<li>
<p><code>9</code> = <code>unknown</code>, when the logging system gets a value it doesn&#39;t recognize.</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>Map the log levels or priorities of other logging systems to their nearest match in the preceding list. For example, from <a href="https://docs.python.org/2.7/library/logging.html#logging-levels">python logging</a>, you can match <code>CRITICAL</code> with <code>crit</code>, <code>ERROR</code> with <code>err</code>, and so on.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_28">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_log_type">.log_type</h3>
<div class="sect4">
<h5 id="_description_28">Description</h5>
<div class="paragraph">
<p>The source type of the log. The <code>log_type</code> field may contain one of these strings, or may have additional dot-separated components, for example &#34;infrastructure.container&#34; or &#34;infrastructure.node&#34;.</p>
</div>
<div class="ulist">
<ul>
<li>
<p>&#34;application&#34;: Container logs generated by user applications running in the cluster, except infrastructure containers.</p>
</li>
<li>
<p>&#34;infrastructure&#34;: Node logs (such as syslog or journal logs), and container logs from pods in the openshift*, kube*, or default projects.</p>
</li>
<li>
<p>&#34;audit&#34;:</p>
<div class="ulist">
<ul>
<li>
<p>Node logs from auditd (/var/log/audit/audit.log)</p>
</li>
<li>
<p>Kubernetes and OpenShift apiservers audit logs.</p>
</li>
<li>
<p>OVN audit logs</p>
</li>
</ul>
</div>
</li>
</ul>
</div>
</div>
<div class="sect4">
<h5 id="_type_29">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_message_2">.message</h3>
<div class="sect4">
<h5 id="_description_29">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Original log entry text, UTF-8 encoded</p>
</div>
<div class="paragraph">
<p>This field may be absent or empty if a non-empty <code>structured</code> field is present.
See the description of <code>structured</code> for additional details.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_30">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_openshift">.openshift</h3>
<div class="sect4">
<h5 id="_description_30">Description</h5>
<div class="paragraph">
<p>Openshift specific metadata</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_31">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">cluster_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>ClusterID is the unique id of the cluster where the workload is deployed</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">labels</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Labels is a set of common, static labels that were spec&#39;d for log forwarding</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">sequence</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Sequence is increasing id used in conjunction with the timestamp to estblish a linear timeline</p>
</div></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_openshift_cluster_id">.openshift.cluster_id</h3>
<div class="sect4">
<h5 id="_description_31">Description</h5>
<div class="paragraph">
<p>ClusterID is the unique id of the cluster where the workload is deployed</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_32">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_openshift_labels">.openshift.labels</h3>
<div class="sect4">
<h5 id="_description_32">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Labels is a set of common, static labels that were spec&#39;d for log forwarding
to be sent with the log Records</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_33">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_openshift_sequence">.openshift.sequence</h3>
<div class="sect4">
<h5 id="_description_33">Description</h5>
<div class="paragraph">
<p>Sequence is increasing id used in conjunction with the timestamp to estblish a linear timeline
of log records.  This was added as a workaround for logstores that do not have nano-second precision.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_34">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata">.pipeline_metadata</h3>
<div class="sect4">
<h5 id="_description_34">Description</h5>
<div class="paragraph">
<p><strong>(DEPRECATED)</strong> <strong>(optional)</strong> Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here.
Data in this subgroup is forwarded for troubleshooting and tracing purposes.  This is only present when deploying
fluentd collector implementations</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_35">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">collector</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Collector metadata</p>
</div></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector">.pipeline_metadata.collector</h3>
<div class="sect4">
<h5 id="_description_35">Description</h5>
<div class="paragraph">
<p>Collector metadata</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_36">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">inputname</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(DEPRECATED)</strong></p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">ipaddr4</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Ipaddr4 is the ipV4 address of the collector</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Name is the implementation of the collector agent</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">original_raw_message</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>OriginalRawMessage captures the original message for eventrouter logs</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">received_at</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>ReceivedAt the time the collector received the log entry</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">version</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Version is collector version information</p>
</div></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_inputname">.pipeline_metadata.collector.inputname</h3>
<div class="sect4">
<h5 id="_description_36">Description</h5>
<div class="paragraph">
<p><strong>(DEPRECATED)</strong></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_37">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_ipaddr4">.pipeline_metadata.collector.ipaddr4</h3>
<div class="sect4">
<h5 id="_description_37">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Ipaddr4 is the ipV4 address of the collector</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_38">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_name">.pipeline_metadata.collector.name</h3>
<div class="sect4">
<h5 id="_description_38">Description</h5>
<div class="paragraph">
<p>Name is the implementation of the collector agent</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_39">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_original_raw_message">.pipeline_metadata.collector.original_raw_message</h3>
<div class="sect4">
<h5 id="_description_39">Description</h5>
<div class="paragraph">
<p>OriginalRawMessage captures the original message for eventrouter logs</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_40">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_received_at">.pipeline_metadata.collector.received_at</h3>
<div class="sect4">
<h5 id="_description_40">Description</h5>
<div class="paragraph">
<p>ReceivedAt the time the collector received the log entry</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_41">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_version">.pipeline_metadata.collector.version</h3>
<div class="sect4">
<h5 id="_description_41">Description</h5>
<div class="paragraph">
<p>Version is collector version information</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_42">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_viaq_index_name">.viaq_index_name</h3>
<div class="sect4">
<h5 id="_description_42">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> ViaqIndexName used with Elasticsearch 6.x and later, this is a name of a write index alias (e.g. app-write).</p>
</div>
<div class="paragraph">
<p>The value depends on the log type of this message. Detailed documentation is found at <a href="https://github.com/openshift/enhancements/blob/master/enhancements/cluster-logging/cluster-logging-es-rollover-data-design.md#data-model" class="bare">https://github.com/openshift/enhancements/blob/master/enhancements/cluster-logging/cluster-logging-es-rollover-data-design.md#data-model</a>.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_43">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_viaq_msg_id">.viaq_msg_id</h3>
<div class="sect4">
<h5 id="_description_43">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> ViaqMessageId is a unique ID assigned to each message. The format is not specified.</p>
</div>
<div class="paragraph">
<p>It may be a UUID or a Base64 (e.g. 82f13a8e-882a-4344-b103-f0a6f30fd218),
or some other ASCII value and is used as the <code>_id</code> of the document when sending to Elasticsearch. The intended use of this field is that if you use another
logging store or application other than Elasticsearch, but you still need to correlate data with the data stored
in Elasticsearch, this field will give you the exact document corresponding to the record.</p>
</div>
<div class="paragraph">
<p>This is only present when deploying fluentd collector implementations</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_44">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
</div>
</div>
<div class="sect1">
<h2 id="_viaq_data_model_for_containers">Viaq Data Model for Containers</h2>
<div class="sectionbody">
<div class="paragraph">
<p>The data model for collected logs from containers.</p>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">@timestamp</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>A UTC value that marks when the log payload was created.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">hostname</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The name of the host where this log message originated. In a Kubernetes cluster, this is the same as <code>kubernetes.host</code>.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">level</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The normalized log level</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">log_type</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The source type of the log. The <code>log_type</code> field may contain one of these strings, or may have additional dot-separated components, for example &#34;infrastructure.container&#34; or &#34;infrastructure.node&#34;.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">message</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Original log entry text, UTF-8 encoded</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">openshift</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Openshift specific metadata</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">pipeline_metadata</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(DEPRECATED)</strong> <strong>(optional)</strong> Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">viaq_index_name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> ViaqIndexName used with Elasticsearch 6.x and later, this is a name of a write index alias (e.g. app-write).</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">viaq_msg_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> ViaqMessageId is a unique ID assigned to each message. The format is not specified.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">docker</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(DEPRECATED)</strong> <strong>(optional)</strong></p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">kubernetes</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The Kubernetes-specific metadata</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">structured</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Original log entry as a structured object.</p>
</div></div></td>
</tr>
</tbody>
</table>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">@timestamp</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>A UTC value that marks when the log payload was created.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">hostname</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The name of the host where this log message originated. In a Kubernetes cluster, this is the same as <code>kubernetes.host</code>.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">level</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The normalized log level</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">log_type</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The source type of the log. The <code>log_type</code> field may contain one of these strings, or may have additional dot-separated components, for example &#34;infrastructure.container&#34; or &#34;infrastructure.node&#34;.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">message</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Original log entry text, UTF-8 encoded</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">openshift</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Openshift specific metadata</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">pipeline_metadata</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(DEPRECATED)</strong> <strong>(optional)</strong> Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">viaq_index_name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> ViaqIndexName used with Elasticsearch 6.x and later, this is a name of a write index alias (e.g. app-write).</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">viaq_msg_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> ViaqMessageId is a unique ID assigned to each message. The format is not specified.</p>
</div></div></td>
</tr>
</tbody>
</table>
<div class="sect2">
<h3 id="_timestamp_2">.@timestamp</h3>
<div class="sect4">
<h5 id="_description_44">Description</h5>
<div class="paragraph">
<p>A UTC value that marks when the log payload was created.</p>
</div>
<div class="paragraph">
<p>If the creation time is not known when the log payload was first collected. The “@” prefix denotes a
field that is reserved for a particular use.</p>
</div>
<div class="paragraph">
<p>format:</p>
</div>
<div class="ulist">
<ul>
<li>
<p>yyyy-MM-dd HH:mm:ss,SSSZ</p>
</li>
<li>
<p>yyyy-MM-dd&#39;T&#39;HH:mm:ss.SSSSSSZ</p>
</li>
<li>
<p>yyyy-MM-dd&#39;T&#39;HH:mm:ssZ</p>
</li>
<li>
<p>dateOptionalTime</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>example: <code>2015-01-24 14:06:05.071000000 Z</code></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_45">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_hostname_2">.hostname</h3>
<div class="sect4">
<h5 id="_description_45">Description</h5>
<div class="paragraph">
<p>The name of the host where this log message originated. In a Kubernetes cluster, this is the same as <code>kubernetes.host</code>.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_46">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_level_2">.level</h3>
<div class="sect4">
<h5 id="_description_46">Description</h5>
<div class="paragraph">
<p>The normalized log level</p>
</div>
<div class="paragraph">
<p>The logging level from various sources, including <code>rsyslog(severitytext property)</code>, python&#39;s logging module, and others.</p>
</div>
<div class="paragraph">
<p>The following values come from <a href="http://sourceware.org/git/?p=glibc.git;a=blob;f=misc/sys/syslog.h;h=ee01478c4b19a954426a96448577c5a76e6647c0;hb=HEAD#l74"><code>syslog.h</code></a>, and are preceded by their <a href="http://sourceware.org/git/?p=glibc.git;a=blob;f=misc/sys/syslog.h;h=ee01478c4b19a954426a96448577c5a76e6647c0;hb=HEAD#l51">numeric equivalents</a>:</p>
</div>
<div class="ulist">
<ul>
<li>
<p><code>0</code> = <code>emerg</code>, system is unusable.</p>
</li>
<li>
<p><code>1</code> = <code>alert</code>, action must be taken immediately.</p>
</li>
<li>
<p><code>2</code> = <code>crit</code>, critical conditions.</p>
</li>
<li>
<p><code>3</code> = <code>err</code>, error conditions.</p>
</li>
<li>
<p><code>4</code> = <code>warn</code>, warning conditions.</p>
</li>
<li>
<p><code>5</code> = <code>notice</code>, normal but significant condition.</p>
</li>
<li>
<p><code>6</code> = <code>info</code>, informational.</p>
</li>
<li>
<p><code>7</code> = <code>debug</code>, debug-level messages.</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>The two following values are not part of <code>syslog.h</code> but are widely used:</p>
</div>
<div class="ulist">
<ul>
<li>
<p><code>8</code> = <code>trace</code>, trace-level messages, which are more verbose than <code>debug</code> messages.</p>
</li>
<li>
<p><code>9</code> = <code>unknown</code>, when the logging system gets a value it doesn&#39;t recognize.</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>Map the log levels or priorities of other logging systems to their nearest match in the preceding list. For example, from <a href="https://docs.python.org/2.7/library/logging.html#logging-levels">python logging</a>, you can match <code>CRITICAL</code> with <code>crit</code>, <code>ERROR</code> with <code>err</code>, and so on.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_47">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_log_type_2">.log_type</h3>
<div class="sect4">
<h5 id="_description_47">Description</h5>
<div class="paragraph">
<p>The source type of the log. The <code>log_type</code> field may contain one of these strings, or may have additional dot-separated components, for example &#34;infrastructure.container&#34; or &#34;infrastructure.node&#34;.</p>
</div>
<div class="ulist">
<ul>
<li>
<p>&#34;application&#34;: Container logs generated by user applications running in the cluster, except infrastructure containers.</p>
</li>
<li>
<p>&#34;infrastructure&#34;: Node logs (such as syslog or journal logs), and container logs from pods in the openshift*, kube*, or default projects.</p>
</li>
<li>
<p>&#34;audit&#34;:</p>
<div class="ulist">
<ul>
<li>
<p>Node logs from auditd (/var/log/audit/audit.log)</p>
</li>
<li>
<p>Kubernetes and OpenShift apiservers audit logs.</p>
</li>
<li>
<p>OVN audit logs</p>
</li>
</ul>
</div>
</li>
</ul>
</div>
</div>
<div class="sect4">
<h5 id="_type_48">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_message_3">.message</h3>
<div class="sect4">
<h5 id="_description_48">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Original log entry text, UTF-8 encoded</p>
</div>
<div class="paragraph">
<p>This field may be absent or empty if a non-empty <code>structured</code> field is present.
See the description of <code>structured</code> for additional details.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_49">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_openshift_2">.openshift</h3>
<div class="sect4">
<h5 id="_description_49">Description</h5>
<div class="paragraph">
<p>Openshift specific metadata</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_50">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">cluster_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>ClusterID is the unique id of the cluster where the workload is deployed</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">labels</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Labels is a set of common, static labels that were spec&#39;d for log forwarding</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">sequence</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Sequence is increasing id used in conjunction with the timestamp to estblish a linear timeline</p>
</div></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_openshift_cluster_id_2">.openshift.cluster_id</h3>
<div class="sect4">
<h5 id="_description_50">Description</h5>
<div class="paragraph">
<p>ClusterID is the unique id of the cluster where the workload is deployed</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_51">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_openshift_labels_2">.openshift.labels</h3>
<div class="sect4">
<h5 id="_description_51">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Labels is a set of common, static labels that were spec&#39;d for log forwarding
to be sent with the log Records</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_52">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_openshift_sequence_2">.openshift.sequence</h3>
<div class="sect4">
<h5 id="_description_52">Description</h5>
<div class="paragraph">
<p>Sequence is increasing id used in conjunction with the timestamp to estblish a linear timeline
of log records.  This was added as a workaround for logstores that do not have nano-second precision.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_53">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_2">.pipeline_metadata</h3>
<div class="sect4">
<h5 id="_description_53">Description</h5>
<div class="paragraph">
<p><strong>(DEPRECATED)</strong> <strong>(optional)</strong> Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here.
Data in this subgroup is forwarded for troubleshooting and tracing purposes.  This is only present when deploying
fluentd collector implementations</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_54">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">collector</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Collector metadata</p>
</div></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_2">.pipeline_metadata.collector</h3>
<div class="sect4">
<h5 id="_description_54">Description</h5>
<div class="paragraph">
<p>Collector metadata</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_55">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">inputname</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(DEPRECATED)</strong></p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">ipaddr4</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Ipaddr4 is the ipV4 address of the collector</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Name is the implementation of the collector agent</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">original_raw_message</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>OriginalRawMessage captures the original message for eventrouter logs</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">received_at</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>ReceivedAt the time the collector received the log entry</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">version</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Version is collector version information</p>
</div></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_inputname_2">.pipeline_metadata.collector.inputname</h3>
<div class="sect4">
<h5 id="_description_55">Description</h5>
<div class="paragraph">
<p><strong>(DEPRECATED)</strong></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_56">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_ipaddr4_2">.pipeline_metadata.collector.ipaddr4</h3>
<div class="sect4">
<h5 id="_description_56">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Ipaddr4 is the ipV4 address of the collector</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_57">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_name_2">.pipeline_metadata.collector.name</h3>
<div class="sect4">
<h5 id="_description_57">Description</h5>
<div class="paragraph">
<p>Name is the implementation of the collector agent</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_58">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_original_raw_message_2">.pipeline_metadata.collector.original_raw_message</h3>
<div class="sect4">
<h5 id="_description_58">Description</h5>
<div class="paragraph">
<p>OriginalRawMessage captures the original message for eventrouter logs</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_59">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_received_at_2">.pipeline_metadata.collector.received_at</h3>
<div class="sect4">
<h5 id="_description_59">Description</h5>
<div class="paragraph">
<p>ReceivedAt the time the collector received the log entry</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_60">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_version_2">.pipeline_metadata.collector.version</h3>
<div class="sect4">
<h5 id="_description_60">Description</h5>
<div class="paragraph">
<p>Version is collector version information</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_61">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_viaq_index_name_2">.viaq_index_name</h3>
<div class="sect4">
<h5 id="_description_61">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> ViaqIndexName used with Elasticsearch 6.x and later, this is a name of a write index alias (e.g. app-write).</p>
</div>
<div class="paragraph">
<p>The value depends on the log type of this message. Detailed documentation is found at <a href="https://github.com/openshift/enhancements/blob/master/enhancements/cluster-logging/cluster-logging-es-rollover-data-design.md#data-model" class="bare">https://github.com/openshift/enhancements/blob/master/enhancements/cluster-logging/cluster-logging-es-rollover-data-design.md#data-model</a>.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_62">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_viaq_msg_id_2">.viaq_msg_id</h3>
<div class="sect4">
<h5 id="_description_62">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> ViaqMessageId is a unique ID assigned to each message. The format is not specified.</p>
</div>
<div class="paragraph">
<p>It may be a UUID or a Base64 (e.g. 82f13a8e-882a-4344-b103-f0a6f30fd218),
or some other ASCII value and is used as the <code>_id</code> of the document when sending to Elasticsearch. The intended use of this field is that if you use another
logging store or application other than Elasticsearch, but you still need to correlate data with the data stored
in Elasticsearch, this field will give you the exact document corresponding to the record.</p>
</div>
<div class="paragraph">
<p>This is only present when deploying fluentd collector implementations</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_63">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_docker">.docker</h3>
<div class="sect4">
<h5 id="_description_63">Description</h5>
<div class="paragraph">
<p><strong>(DEPRECATED)</strong> <strong>(optional)</strong></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_64">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">container_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>ContainerID is the id of the container producing the log</p>
</div></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_docker_container_id">.docker.container_id</h3>
<div class="sect4">
<h5 id="_description_64">Description</h5>
<div class="paragraph">
<p>ContainerID is the id of the container producing the log</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_65">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes">.kubernetes</h3>
<div class="sect4">
<h5 id="_description_65">Description</h5>
<div class="paragraph">
<p>The Kubernetes-specific metadata</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_66">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">annotations</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Annotations associated with the Kubernetes pod</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">container_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong></p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">container_image</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong></p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">container_image_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong></p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">container_name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>ContainerName of the the pod container that produced the log</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">flat_labels</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">array</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(DEPRECATED)</strong> <strong>(optional)</strong> FlatLabels is an array of the pod labels joined as key=value</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">host</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Host is the kubernetes node name that hosts the pod</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">labels</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Labels present on the Pod at time the log was generated</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">master_url</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(DEPRECATED)</strong> MasterURL is the url to the apiserver</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">namespace_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> NamespaceID is the unique uuid of the namespace</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">namespace_labels</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> NamespaceLabels are the labels present on the pod namespace</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">namespace_name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>NamespaceName where the pod is deployed</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">pod_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> PodID is the unique uuid of the pod</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">pod_name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>PodName is the name of the pod</p>
</div></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_annotations">.kubernetes.annotations</h3>
<div class="sect4">
<h5 id="_description_66">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Annotations associated with the Kubernetes pod</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_67">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_container_id">.kubernetes.container_id</h3>
<div class="sect4">
<h5 id="_description_67">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_68">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_container_image">.kubernetes.container_image</h3>
<div class="sect4">
<h5 id="_description_68">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_69">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_container_image_id">.kubernetes.container_image_id</h3>
<div class="sect4">
<h5 id="_description_69">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_70">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_container_name">.kubernetes.container_name</h3>
<div class="sect4">
<h5 id="_description_70">Description</h5>
<div class="paragraph">
<p>ContainerName of the the pod container that produced the log</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_71">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_flat_labels">.kubernetes.flat_labels[]</h3>
<div class="sect4">
<h5 id="_description_71">Description</h5>
<div class="paragraph">
<p><strong>(DEPRECATED)</strong> <strong>(optional)</strong> FlatLabels is an array of the pod labels joined as key=value</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_72">Type</h5>
<div class="ulist">
<ul>
<li>
<p>array</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_host">.kubernetes.host</h3>
<div class="sect4">
<h5 id="_description_72">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Host is the kubernetes node name that hosts the pod</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_73">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_labels">.kubernetes.labels</h3>
<div class="sect4">
<h5 id="_description_73">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Labels present on the Pod at time the log was generated</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_74">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_master_url">.kubernetes.master_url</h3>
<div class="sect4">
<h5 id="_description_74">Description</h5>
<div class="paragraph">
<p><strong>(DEPRECATED)</strong> MasterURL is the url to the apiserver</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_75">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_namespace_id">.kubernetes.namespace_id</h3>
<div class="sect4">
<h5 id="_description_75">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> NamespaceID is the unique uuid of the namespace</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_76">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_namespace_labels">.kubernetes.namespace_labels</h3>
<div class="sect4">
<h5 id="_description_76">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> NamespaceLabels are the labels present on the pod namespace</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_77">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_namespace_name">.kubernetes.namespace_name</h3>
<div class="sect4">
<h5 id="_description_77">Description</h5>
<div class="paragraph">
<p>NamespaceName where the pod is deployed</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_78">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_pod_id">.kubernetes.pod_id</h3>
<div class="sect4">
<h5 id="_description_78">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> PodID is the unique uuid of the pod</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_79">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_pod_name">.kubernetes.pod_name</h3>
<div class="sect4">
<h5 id="_description_79">Description</h5>
<div class="paragraph">
<p>PodName is the name of the pod</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_80">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_structured">.structured</h3>
<div class="sect4">
<h5 id="_description_80">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Original log entry as a structured object.</p>
</div>
<div class="paragraph">
<p>Example:
<code>{&#34;pid&#34;:21631,&#34;ppid&#34;:21618,&#34;worker&#34;:0,&#34;message&#34;:&#34;starting fluentd worker pid=21631 ppid=21618 worker=0&#34;}</code></p>
</div>
<div class="paragraph">
<p>This field may be present if the forwarder was configured to parse structured JSON logs.
If the original log entry was a valid structured log, this field will contain an equivalent JSON structure.
Otherwise this field will be empty or absent, and the <code>message</code> field will contain the original log message.
The <code>structured</code> field includes the same sub-fields as the original log message.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_81">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
</div>
</div>
</div>
</div>
<div class="sect1">
<h2 id="_viaq_data_model_for_eventrouter">Viaq Data Model for EventRouter</h2>
<div class="sectionbody">
<div class="paragraph">
<p>The data model for event logs collected from the EventRouter.</p>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">@timestamp</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>A UTC value that marks when the log payload was created.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">hostname</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The name of the host where this log message originated. In a Kubernetes cluster, this is the same as <code>kubernetes.host</code>.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">level</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The normalized log level</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">log_type</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The source type of the log. The <code>log_type</code> field may contain one of these strings, or may have additional dot-separated components, for example &#34;infrastructure.container&#34; or &#34;infrastructure.node&#34;.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">message</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Original log entry text, UTF-8 encoded</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">openshift</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Openshift specific metadata</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">pipeline_metadata</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(DEPRECATED)</strong> <strong>(optional)</strong> Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">viaq_index_name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> ViaqIndexName used with Elasticsearch 6.x and later, this is a name of a write index alias (e.g. app-write).</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">viaq_msg_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> ViaqMessageId is a unique ID assigned to each message. The format is not specified.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">kubernetes</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The Kubernetes-specific metadata</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">old_event</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>OldEvent is a core KubernetesEvent that was replaced by</p>
</div></div></td>
</tr>
</tbody>
</table>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">@timestamp</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>A UTC value that marks when the log payload was created.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">hostname</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The name of the host where this log message originated. In a Kubernetes cluster, this is the same as <code>kubernetes.host</code>.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">level</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The normalized log level</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">log_type</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The source type of the log. The <code>log_type</code> field may contain one of these strings, or may have additional dot-separated components, for example &#34;infrastructure.container&#34; or &#34;infrastructure.node&#34;.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">message</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Original log entry text, UTF-8 encoded</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">openshift</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Openshift specific metadata</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">pipeline_metadata</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(DEPRECATED)</strong> <strong>(optional)</strong> Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">viaq_index_name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> ViaqIndexName used with Elasticsearch 6.x and later, this is a name of a write index alias (e.g. app-write).</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">viaq_msg_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> ViaqMessageId is a unique ID assigned to each message. The format is not specified.</p>
</div></div></td>
</tr>
</tbody>
</table>
<div class="sect2">
<h3 id="_timestamp_3">.@timestamp</h3>
<div class="sect4">
<h5 id="_description_81">Description</h5>
<div class="paragraph">
<p>A UTC value that marks when the log payload was created.</p>
</div>
<div class="paragraph">
<p>If the creation time is not known when the log payload was first collected. The “@” prefix denotes a
field that is reserved for a particular use.</p>
</div>
<div class="paragraph">
<p>format:</p>
</div>
<div class="ulist">
<ul>
<li>
<p>yyyy-MM-dd HH:mm:ss,SSSZ</p>
</li>
<li>
<p>yyyy-MM-dd&#39;T&#39;HH:mm:ss.SSSSSSZ</p>
</li>
<li>
<p>yyyy-MM-dd&#39;T&#39;HH:mm:ssZ</p>
</li>
<li>
<p>dateOptionalTime</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>example: <code>2015-01-24 14:06:05.071000000 Z</code></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_82">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_hostname_3">.hostname</h3>
<div class="sect4">
<h5 id="_description_82">Description</h5>
<div class="paragraph">
<p>The name of the host where this log message originated. In a Kubernetes cluster, this is the same as <code>kubernetes.host</code>.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_83">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_level_3">.level</h3>
<div class="sect4">
<h5 id="_description_83">Description</h5>
<div class="paragraph">
<p>The normalized log level</p>
</div>
<div class="paragraph">
<p>The logging level from various sources, including <code>rsyslog(severitytext property)</code>, python&#39;s logging module, and others.</p>
</div>
<div class="paragraph">
<p>The following values come from <a href="http://sourceware.org/git/?p=glibc.git;a=blob;f=misc/sys/syslog.h;h=ee01478c4b19a954426a96448577c5a76e6647c0;hb=HEAD#l74"><code>syslog.h</code></a>, and are preceded by their <a href="http://sourceware.org/git/?p=glibc.git;a=blob;f=misc/sys/syslog.h;h=ee01478c4b19a954426a96448577c5a76e6647c0;hb=HEAD#l51">numeric equivalents</a>:</p>
</div>
<div class="ulist">
<ul>
<li>
<p><code>0</code> = <code>emerg</code>, system is unusable.</p>
</li>
<li>
<p><code>1</code> = <code>alert</code>, action must be taken immediately.</p>
</li>
<li>
<p><code>2</code> = <code>crit</code>, critical conditions.</p>
</li>
<li>
<p><code>3</code> = <code>err</code>, error conditions.</p>
</li>
<li>
<p><code>4</code> = <code>warn</code>, warning conditions.</p>
</li>
<li>
<p><code>5</code> = <code>notice</code>, normal but significant condition.</p>
</li>
<li>
<p><code>6</code> = <code>info</code>, informational.</p>
</li>
<li>
<p><code>7</code> = <code>debug</code>, debug-level messages.</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>The two following values are not part of <code>syslog.h</code> but are widely used:</p>
</div>
<div class="ulist">
<ul>
<li>
<p><code>8</code> = <code>trace</code>, trace-level messages, which are more verbose than <code>debug</code> messages.</p>
</li>
<li>
<p><code>9</code> = <code>unknown</code>, when the logging system gets a value it doesn&#39;t recognize.</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>Map the log levels or priorities of other logging systems to their nearest match in the preceding list. For example, from <a href="https://docs.python.org/2.7/library/logging.html#logging-levels">python logging</a>, you can match <code>CRITICAL</code> with <code>crit</code>, <code>ERROR</code> with <code>err</code>, and so on.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_84">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_log_type_3">.log_type</h3>
<div class="sect4">
<h5 id="_description_84">Description</h5>
<div class="paragraph">
<p>The source type of the log. The <code>log_type</code> field may contain one of these strings, or may have additional dot-separated components, for example &#34;infrastructure.container&#34; or &#34;infrastructure.node&#34;.</p>
</div>
<div class="ulist">
<ul>
<li>
<p>&#34;application&#34;: Container logs generated by user applications running in the cluster, except infrastructure containers.</p>
</li>
<li>
<p>&#34;infrastructure&#34;: Node logs (such as syslog or journal logs), and container logs from pods in the openshift*, kube*, or default projects.</p>
</li>
<li>
<p>&#34;audit&#34;:</p>
<div class="ulist">
<ul>
<li>
<p>Node logs from auditd (/var/log/audit/audit.log)</p>
</li>
<li>
<p>Kubernetes and OpenShift apiservers audit logs.</p>
</li>
<li>
<p>OVN audit logs</p>
</li>
</ul>
</div>
</li>
</ul>
</div>
</div>
<div class="sect4">
<h5 id="_type_85">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_message_4">.message</h3>
<div class="sect4">
<h5 id="_description_85">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Original log entry text, UTF-8 encoded</p>
</div>
<div class="paragraph">
<p>This field may be absent or empty if a non-empty <code>structured</code> field is present.
See the description of <code>structured</code> for additional details.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_86">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_openshift_3">.openshift</h3>
<div class="sect4">
<h5 id="_description_86">Description</h5>
<div class="paragraph">
<p>Openshift specific metadata</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_87">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">cluster_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>ClusterID is the unique id of the cluster where the workload is deployed</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">labels</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Labels is a set of common, static labels that were spec&#39;d for log forwarding</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">sequence</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Sequence is increasing id used in conjunction with the timestamp to estblish a linear timeline</p>
</div></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_openshift_cluster_id_3">.openshift.cluster_id</h3>
<div class="sect4">
<h5 id="_description_87">Description</h5>
<div class="paragraph">
<p>ClusterID is the unique id of the cluster where the workload is deployed</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_88">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_openshift_labels_3">.openshift.labels</h3>
<div class="sect4">
<h5 id="_description_88">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Labels is a set of common, static labels that were spec&#39;d for log forwarding
to be sent with the log Records</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_89">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_openshift_sequence_3">.openshift.sequence</h3>
<div class="sect4">
<h5 id="_description_89">Description</h5>
<div class="paragraph">
<p>Sequence is increasing id used in conjunction with the timestamp to estblish a linear timeline
of log records.  This was added as a workaround for logstores that do not have nano-second precision.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_90">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_3">.pipeline_metadata</h3>
<div class="sect4">
<h5 id="_description_90">Description</h5>
<div class="paragraph">
<p><strong>(DEPRECATED)</strong> <strong>(optional)</strong> Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here.
Data in this subgroup is forwarded for troubleshooting and tracing purposes.  This is only present when deploying
fluentd collector implementations</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_91">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">collector</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Collector metadata</p>
</div></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_3">.pipeline_metadata.collector</h3>
<div class="sect4">
<h5 id="_description_91">Description</h5>
<div class="paragraph">
<p>Collector metadata</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_92">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">inputname</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(DEPRECATED)</strong></p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">ipaddr4</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Ipaddr4 is the ipV4 address of the collector</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Name is the implementation of the collector agent</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">original_raw_message</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>OriginalRawMessage captures the original message for eventrouter logs</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">received_at</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>ReceivedAt the time the collector received the log entry</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">version</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Version is collector version information</p>
</div></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_inputname_3">.pipeline_metadata.collector.inputname</h3>
<div class="sect4">
<h5 id="_description_92">Description</h5>
<div class="paragraph">
<p><strong>(DEPRECATED)</strong></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_93">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_ipaddr4_3">.pipeline_metadata.collector.ipaddr4</h3>
<div class="sect4">
<h5 id="_description_93">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Ipaddr4 is the ipV4 address of the collector</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_94">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_name_3">.pipeline_metadata.collector.name</h3>
<div class="sect4">
<h5 id="_description_94">Description</h5>
<div class="paragraph">
<p>Name is the implementation of the collector agent</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_95">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_original_raw_message_3">.pipeline_metadata.collector.original_raw_message</h3>
<div class="sect4">
<h5 id="_description_95">Description</h5>
<div class="paragraph">
<p>OriginalRawMessage captures the original message for eventrouter logs</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_96">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_received_at_3">.pipeline_metadata.collector.received_at</h3>
<div class="sect4">
<h5 id="_description_96">Description</h5>
<div class="paragraph">
<p>ReceivedAt the time the collector received the log entry</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_97">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_version_3">.pipeline_metadata.collector.version</h3>
<div class="sect4">
<h5 id="_description_97">Description</h5>
<div class="paragraph">
<p>Version is collector version information</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_98">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_viaq_index_name_3">.viaq_index_name</h3>
<div class="sect4">
<h5 id="_description_98">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> ViaqIndexName used with Elasticsearch 6.x and later, this is a name of a write index alias (e.g. app-write).</p>
</div>
<div class="paragraph">
<p>The value depends on the log type of this message. Detailed documentation is found at <a href="https://github.com/openshift/enhancements/blob/master/enhancements/cluster-logging/cluster-logging-es-rollover-data-design.md#data-model" class="bare">https://github.com/openshift/enhancements/blob/master/enhancements/cluster-logging/cluster-logging-es-rollover-data-design.md#data-model</a>.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_99">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_viaq_msg_id_3">.viaq_msg_id</h3>
<div class="sect4">
<h5 id="_description_99">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> ViaqMessageId is a unique ID assigned to each message. The format is not specified.</p>
</div>
<div class="paragraph">
<p>It may be a UUID or a Base64 (e.g. 82f13a8e-882a-4344-b103-f0a6f30fd218),
or some other ASCII value and is used as the <code>_id</code> of the document when sending to Elasticsearch. The intended use of this field is that if you use another
logging store or application other than Elasticsearch, but you still need to correlate data with the data stored
in Elasticsearch, this field will give you the exact document corresponding to the record.</p>
</div>
<div class="paragraph">
<p>This is only present when deploying fluentd collector implementations</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_100">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_2">.kubernetes</h3>
<div class="sect4">
<h5 id="_description_100">Description</h5>
<div class="paragraph">
<p>The Kubernetes-specific metadata</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_101">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">annotations</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Annotations associated with the Kubernetes pod</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">container_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong></p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">container_image</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong></p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">container_image_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong></p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">container_name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>ContainerName of the the pod container that produced the log</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">flat_labels</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">array</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(DEPRECATED)</strong> <strong>(optional)</strong> FlatLabels is an array of the pod labels joined as key=value</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">host</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Host is the kubernetes node name that hosts the pod</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">labels</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Labels present on the Pod at time the log was generated</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">master_url</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(DEPRECATED)</strong> MasterURL is the url to the apiserver</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">namespace_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> NamespaceID is the unique uuid of the namespace</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">namespace_labels</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> NamespaceLabels are the labels present on the pod namespace</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">namespace_name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>NamespaceName where the pod is deployed</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">pod_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> PodID is the unique uuid of the pod</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">pod_name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>PodName is the name of the pod</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">event</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Event is the core KubernetesEvent</p>
</div></div></td>
</tr>
</tbody>
</table>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">annotations</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Annotations associated with the Kubernetes pod</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">container_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong></p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">container_image</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong></p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">container_image_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong></p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">container_name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>ContainerName of the the pod container that produced the log</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">flat_labels</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">array</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(DEPRECATED)</strong> <strong>(optional)</strong> FlatLabels is an array of the pod labels joined as key=value</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">host</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Host is the kubernetes node name that hosts the pod</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">labels</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Labels present on the Pod at time the log was generated</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">master_url</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(DEPRECATED)</strong> MasterURL is the url to the apiserver</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">namespace_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> NamespaceID is the unique uuid of the namespace</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">namespace_labels</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> NamespaceLabels are the labels present on the pod namespace</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">namespace_name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>NamespaceName where the pod is deployed</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">pod_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> PodID is the unique uuid of the pod</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">pod_name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>PodName is the name of the pod</p>
</div></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_annotations_2">.kubernetes.annotations</h3>
<div class="sect4">
<h5 id="_description_101">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Annotations associated with the Kubernetes pod</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_102">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_container_id_2">.kubernetes.container_id</h3>
<div class="sect4">
<h5 id="_description_102">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_103">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_container_image_2">.kubernetes.container_image</h3>
<div class="sect4">
<h5 id="_description_103">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_104">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_container_image_id_2">.kubernetes.container_image_id</h3>
<div class="sect4">
<h5 id="_description_104">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_105">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_container_name_2">.kubernetes.container_name</h3>
<div class="sect4">
<h5 id="_description_105">Description</h5>
<div class="paragraph">
<p>ContainerName of the the pod container that produced the log</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_106">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_flat_labels_2">.kubernetes.flat_labels[]</h3>
<div class="sect4">
<h5 id="_description_106">Description</h5>
<div class="paragraph">
<p><strong>(DEPRECATED)</strong> <strong>(optional)</strong> FlatLabels is an array of the pod labels joined as key=value</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_107">Type</h5>
<div class="ulist">
<ul>
<li>
<p>array</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_host_2">.kubernetes.host</h3>
<div class="sect4">
<h5 id="_description_107">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Host is the kubernetes node name that hosts the pod</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_108">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_labels_2">.kubernetes.labels</h3>
<div class="sect4">
<h5 id="_description_108">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Labels present on the Pod at time the log was generated</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_109">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_master_url_2">.kubernetes.master_url</h3>
<div class="sect4">
<h5 id="_description_109">Description</h5>
<div class="paragraph">
<p><strong>(DEPRECATED)</strong> MasterURL is the url to the apiserver</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_110">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_namespace_id_2">.kubernetes.namespace_id</h3>
<div class="sect4">
<h5 id="_description_110">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> NamespaceID is the unique uuid of the namespace</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_111">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_namespace_labels_2">.kubernetes.namespace_labels</h3>
<div class="sect4">
<h5 id="_description_111">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> NamespaceLabels are the labels present on the pod namespace</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_112">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_namespace_name_2">.kubernetes.namespace_name</h3>
<div class="sect4">
<h5 id="_description_112">Description</h5>
<div class="paragraph">
<p>NamespaceName where the pod is deployed</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_113">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_pod_id_2">.kubernetes.pod_id</h3>
<div class="sect4">
<h5 id="_description_113">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> PodID is the unique uuid of the pod</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_114">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_pod_name_2">.kubernetes.pod_name</h3>
<div class="sect4">
<h5 id="_description_114">Description</h5>
<div class="paragraph">
<p>PodName is the name of the pod</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_115">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event">.kubernetes.event</h3>
<div class="sect4">
<h5 id="_description_115">Description</h5>
<div class="paragraph">
<p>Event is the core KubernetesEvent</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_116">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">action</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> What action was taken/failed regarding to the Regarding object.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">count</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">int</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> The number of times this event has occurred.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">eventTime</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Time when this Event was first observed.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">firstTimestamp</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> The time at which the event was first recorded. (Time of server receipt is in TypeMeta.)</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">involvedObject</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The object that this event is about.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">lastTimestamp</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> The time at which the most recent occurrence of this event was recorded.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">message</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> A human-readable description of the status of this operation.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">reason</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> This should be a short, machine understandable string that gives the reason</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">related</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Optional secondary object for more complex actions.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">reportingComponent</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Name of the controller that emitted this Event, e.g. <code>kubernetes.io/kubelet</code>.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">reportingInstance</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> ID of the controller instance, e.g. <code>kubelet-xyzf</code>.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">series</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Data about the Event series this event represents or nil if it&#39;s a singleton Event.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">source</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> The component reporting this event. Should be a short machine understandable string.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">type</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Type of this event (Normal, Warning), new types could be added in the future</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">verb</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Verb is indicates if event was created or updated</p>
</div></div></td>
</tr>
</tbody>
</table>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">action</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> What action was taken/failed regarding to the Regarding object.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">count</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">int</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> The number of times this event has occurred.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">eventTime</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Time when this Event was first observed.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">firstTimestamp</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> The time at which the event was first recorded. (Time of server receipt is in TypeMeta.)</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">involvedObject</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The object that this event is about.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">lastTimestamp</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> The time at which the most recent occurrence of this event was recorded.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">message</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> A human-readable description of the status of this operation.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">reason</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> This should be a short, machine understandable string that gives the reason</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">related</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Optional secondary object for more complex actions.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">reportingComponent</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Name of the controller that emitted this Event, e.g. <code>kubernetes.io/kubelet</code>.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">reportingInstance</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> ID of the controller instance, e.g. <code>kubelet-xyzf</code>.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">series</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Data about the Event series this event represents or nil if it&#39;s a singleton Event.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">source</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> The component reporting this event. Should be a short machine understandable string.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">type</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Type of this event (Normal, Warning), new types could be added in the future</p>
</div></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_action">.kubernetes.event.action</h3>
<div class="sect4">
<h5 id="_description_116">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> What action was taken/failed regarding to the Regarding object.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_117">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_count">.kubernetes.event.count</h3>
<div class="sect4">
<h5 id="_description_117">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> The number of times this event has occurred.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_118">Type</h5>
<div class="ulist">
<ul>
<li>
<p>int</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_eventtime">.kubernetes.event.eventTime</h3>
<div class="sect4">
<h5 id="_description_118">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Time when this Event was first observed.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_119">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">Time</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_eventtime_time">.kubernetes.event.eventTime.Time</h3>
<div class="sect4">
<h5 id="_description_119">Description</h5>

</div>
<div class="sect4">
<h5 id="_type_120">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_firsttimestamp">.kubernetes.event.firstTimestamp</h3>
<div class="sect4">
<h5 id="_description_120">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> The time at which the event was first recorded. (Time of server receipt is in TypeMeta.)</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_121">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_involvedobject">.kubernetes.event.involvedObject</h3>
<div class="sect4">
<h5 id="_description_121">Description</h5>
<div class="paragraph">
<p>The object that this event is about.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_122">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">apiVersion</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> API version of the referent.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">fieldPath</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> If referring to a piece of an object instead of an entire object, this string</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">kind</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Kind of the referent.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Name of the referent.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">namespace</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Namespace of the referent.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">resourceVersion</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Specific resourceVersion to which this reference is made, if any.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">uid</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> UID of the referent.</p>
</div></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_involvedobject_apiversion">.kubernetes.event.involvedObject.apiVersion</h3>
<div class="sect4">
<h5 id="_description_122">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> API version of the referent.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_123">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_involvedobject_fieldpath">.kubernetes.event.involvedObject.fieldPath</h3>
<div class="sect4">
<h5 id="_description_123">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> If referring to a piece of an object instead of an entire object, this string
should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
For example, if the object reference is to a container within a pod, this would take on a value like:
&#34;spec.containers{name}&#34; (where &#34;name&#34; refers to the name of the container that triggered
the event) or if no container name is specified &#34;spec.containers[2]&#34; (container with
index 2 in this pod). This syntax is chosen only to have some well-defined way of
referencing a part of an object.
TODO: this design is not final and this field is subject to change in the future.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_124">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_involvedobject_kind">.kubernetes.event.involvedObject.kind</h3>
<div class="sect4">
<h5 id="_description_124">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Kind of the referent.
More info: <a href="https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds" class="bare">https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds</a></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_125">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_involvedobject_name">.kubernetes.event.involvedObject.name</h3>
<div class="sect4">
<h5 id="_description_125">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Name of the referent.
More info: <a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names" class="bare">https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names</a></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_126">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_involvedobject_namespace">.kubernetes.event.involvedObject.namespace</h3>
<div class="sect4">
<h5 id="_description_126">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Namespace of the referent.
More info: <a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/" class="bare">https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/</a></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_127">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_involvedobject_resourceversion">.kubernetes.event.involvedObject.resourceVersion</h3>
<div class="sect4">
<h5 id="_description_127">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Specific resourceVersion to which this reference is made, if any.
More info: <a href="https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency" class="bare">https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency</a></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_128">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_involvedobject_uid">.kubernetes.event.involvedObject.uid</h3>
<div class="sect4">
<h5 id="_description_128">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> UID of the referent.
More info: <a href="https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids" class="bare">https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids</a></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_129">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_lasttimestamp">.kubernetes.event.lastTimestamp</h3>
<div class="sect4">
<h5 id="_description_129">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> The time at which the most recent occurrence of this event was recorded.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_130">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_message">.kubernetes.event.message</h3>
<div class="sect4">
<h5 id="_description_130">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> A human-readable description of the status of this operation.
TODO: decide on maximum length.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_131">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_reason">.kubernetes.event.reason</h3>
<div class="sect4">
<h5 id="_description_131">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> This should be a short, machine understandable string that gives the reason
for the transition into the object&#39;s current status.
TODO: provide exact specification for format.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_132">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_related">.kubernetes.event.related</h3>
<div class="sect4">
<h5 id="_description_132">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Optional secondary object for more complex actions.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_133">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_reportingcomponent">.kubernetes.event.reportingComponent</h3>
<div class="sect4">
<h5 id="_description_133">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Name of the controller that emitted this Event, e.g. <code>kubernetes.io/kubelet</code>.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_134">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_reportinginstance">.kubernetes.event.reportingInstance</h3>
<div class="sect4">
<h5 id="_description_134">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> ID of the controller instance, e.g. <code>kubelet-xyzf</code>.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_135">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_series">.kubernetes.event.series</h3>
<div class="sect4">
<h5 id="_description_135">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Data about the Event series this event represents or nil if it&#39;s a singleton Event.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_136">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_source">.kubernetes.event.source</h3>
<div class="sect4">
<h5 id="_description_136">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> The component reporting this event. Should be a short machine understandable string.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_137">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">component</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Component from which the event is generated.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">host</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Node name on which the event is generated.</p>
</div></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_source_component">.kubernetes.event.source.component</h3>
<div class="sect4">
<h5 id="_description_137">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Component from which the event is generated.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_138">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_source_host">.kubernetes.event.source.host</h3>
<div class="sect4">
<h5 id="_description_138">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Node name on which the event is generated.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_139">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_type">.kubernetes.event.type</h3>
<div class="sect4">
<h5 id="_description_139">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Type of this event (Normal, Warning), new types could be added in the future</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_140">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_kubernetes_event_verb">.kubernetes.event.verb</h3>
<div class="sect4">
<h5 id="_description_140">Description</h5>
<div class="paragraph">
<p>Verb is indicates if event was created or updated</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_141">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_old_event">.old_event</h3>
<div class="sect4">
<h5 id="_description_141">Description</h5>
<div class="paragraph">
<p>OldEvent is a core KubernetesEvent that was replaced by
kubernetes.event</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_142">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
</div>
</div>
</div>
</div>
<div class="sect1">
<h2 id="_viaq_data_model_for_journald">Viaq Data Model for journald</h2>
<div class="sectionbody">
<div class="paragraph">
<p>The data model for collected logs from node journal.</p>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">@timestamp</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>A UTC value that marks when the log payload was created.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">hostname</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The name of the host where this log message originated. In a Kubernetes cluster, this is the same as <code>kubernetes.host</code>.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">level</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The normalized log level</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">log_type</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The source type of the log. The <code>log_type</code> field may contain one of these strings, or may have additional dot-separated components, for example &#34;infrastructure.container&#34; or &#34;infrastructure.node&#34;.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">message</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Original log entry text, UTF-8 encoded</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">openshift</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Openshift specific metadata</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">pipeline_metadata</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(DEPRECATED)</strong> <strong>(optional)</strong> Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">viaq_index_name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> ViaqIndexName used with Elasticsearch 6.x and later, this is a name of a write index alias (e.g. app-write).</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">viaq_msg_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> ViaqMessageId is a unique ID assigned to each message. The format is not specified.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">_STREAM_ID</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">_SYSTEMD_INVOCATION_ID</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">systemd</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"></div></td>
</tr>
</tbody>
</table>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">@timestamp</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>A UTC value that marks when the log payload was created.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">hostname</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The name of the host where this log message originated. In a Kubernetes cluster, this is the same as <code>kubernetes.host</code>.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">level</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The normalized log level</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">log_type</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>The source type of the log. The <code>log_type</code> field may contain one of these strings, or may have additional dot-separated components, for example &#34;infrastructure.container&#34; or &#34;infrastructure.node&#34;.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">message</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Original log entry text, UTF-8 encoded</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">openshift</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Openshift specific metadata</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">pipeline_metadata</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(DEPRECATED)</strong> <strong>(optional)</strong> Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here.</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">viaq_index_name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> ViaqIndexName used with Elasticsearch 6.x and later, this is a name of a write index alias (e.g. app-write).</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">viaq_msg_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> ViaqMessageId is a unique ID assigned to each message. The format is not specified.</p>
</div></div></td>
</tr>
</tbody>
</table>
<div class="sect2">
<h3 id="_timestamp_4">.@timestamp</h3>
<div class="sect4">
<h5 id="_description_142">Description</h5>
<div class="paragraph">
<p>A UTC value that marks when the log payload was created.</p>
</div>
<div class="paragraph">
<p>If the creation time is not known when the log payload was first collected. The “@” prefix denotes a
field that is reserved for a particular use.</p>
</div>
<div class="paragraph">
<p>format:</p>
</div>
<div class="ulist">
<ul>
<li>
<p>yyyy-MM-dd HH:mm:ss,SSSZ</p>
</li>
<li>
<p>yyyy-MM-dd&#39;T&#39;HH:mm:ss.SSSSSSZ</p>
</li>
<li>
<p>yyyy-MM-dd&#39;T&#39;HH:mm:ssZ</p>
</li>
<li>
<p>dateOptionalTime</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>example: <code>2015-01-24 14:06:05.071000000 Z</code></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_143">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_hostname_4">.hostname</h3>
<div class="sect4">
<h5 id="_description_143">Description</h5>
<div class="paragraph">
<p>The name of the host where this log message originated. In a Kubernetes cluster, this is the same as <code>kubernetes.host</code>.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_144">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_level_4">.level</h3>
<div class="sect4">
<h5 id="_description_144">Description</h5>
<div class="paragraph">
<p>The normalized log level</p>
</div>
<div class="paragraph">
<p>The logging level from various sources, including <code>rsyslog(severitytext property)</code>, python&#39;s logging module, and others.</p>
</div>
<div class="paragraph">
<p>The following values come from <a href="http://sourceware.org/git/?p=glibc.git;a=blob;f=misc/sys/syslog.h;h=ee01478c4b19a954426a96448577c5a76e6647c0;hb=HEAD#l74"><code>syslog.h</code></a>, and are preceded by their <a href="http://sourceware.org/git/?p=glibc.git;a=blob;f=misc/sys/syslog.h;h=ee01478c4b19a954426a96448577c5a76e6647c0;hb=HEAD#l51">numeric equivalents</a>:</p>
</div>
<div class="ulist">
<ul>
<li>
<p><code>0</code> = <code>emerg</code>, system is unusable.</p>
</li>
<li>
<p><code>1</code> = <code>alert</code>, action must be taken immediately.</p>
</li>
<li>
<p><code>2</code> = <code>crit</code>, critical conditions.</p>
</li>
<li>
<p><code>3</code> = <code>err</code>, error conditions.</p>
</li>
<li>
<p><code>4</code> = <code>warn</code>, warning conditions.</p>
</li>
<li>
<p><code>5</code> = <code>notice</code>, normal but significant condition.</p>
</li>
<li>
<p><code>6</code> = <code>info</code>, informational.</p>
</li>
<li>
<p><code>7</code> = <code>debug</code>, debug-level messages.</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>The two following values are not part of <code>syslog.h</code> but are widely used:</p>
</div>
<div class="ulist">
<ul>
<li>
<p><code>8</code> = <code>trace</code>, trace-level messages, which are more verbose than <code>debug</code> messages.</p>
</li>
<li>
<p><code>9</code> = <code>unknown</code>, when the logging system gets a value it doesn&#39;t recognize.</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>Map the log levels or priorities of other logging systems to their nearest match in the preceding list. For example, from <a href="https://docs.python.org/2.7/library/logging.html#logging-levels">python logging</a>, you can match <code>CRITICAL</code> with <code>crit</code>, <code>ERROR</code> with <code>err</code>, and so on.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_145">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_log_type_4">.log_type</h3>
<div class="sect4">
<h5 id="_description_145">Description</h5>
<div class="paragraph">
<p>The source type of the log. The <code>log_type</code> field may contain one of these strings, or may have additional dot-separated components, for example &#34;infrastructure.container&#34; or &#34;infrastructure.node&#34;.</p>
</div>
<div class="ulist">
<ul>
<li>
<p>&#34;application&#34;: Container logs generated by user applications running in the cluster, except infrastructure containers.</p>
</li>
<li>
<p>&#34;infrastructure&#34;: Node logs (such as syslog or journal logs), and container logs from pods in the openshift*, kube*, or default projects.</p>
</li>
<li>
<p>&#34;audit&#34;:</p>
<div class="ulist">
<ul>
<li>
<p>Node logs from auditd (/var/log/audit/audit.log)</p>
</li>
<li>
<p>Kubernetes and OpenShift apiservers audit logs.</p>
</li>
<li>
<p>OVN audit logs</p>
</li>
</ul>
</div>
</li>
</ul>
</div>
</div>
<div class="sect4">
<h5 id="_type_146">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_message_5">.message</h3>
<div class="sect4">
<h5 id="_description_146">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Original log entry text, UTF-8 encoded</p>
</div>
<div class="paragraph">
<p>This field may be absent or empty if a non-empty <code>structured</code> field is present.
See the description of <code>structured</code> for additional details.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_147">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_openshift_4">.openshift</h3>
<div class="sect4">
<h5 id="_description_147">Description</h5>
<div class="paragraph">
<p>Openshift specific metadata</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_148">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">cluster_id</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>ClusterID is the unique id of the cluster where the workload is deployed</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">labels</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Labels is a set of common, static labels that were spec&#39;d for log forwarding</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">sequence</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Sequence is increasing id used in conjunction with the timestamp to estblish a linear timeline</p>
</div></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_openshift_cluster_id_4">.openshift.cluster_id</h3>
<div class="sect4">
<h5 id="_description_148">Description</h5>
<div class="paragraph">
<p>ClusterID is the unique id of the cluster where the workload is deployed</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_149">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_openshift_labels_4">.openshift.labels</h3>
<div class="sect4">
<h5 id="_description_149">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Labels is a set of common, static labels that were spec&#39;d for log forwarding
to be sent with the log Records</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_150">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_openshift_sequence_4">.openshift.sequence</h3>
<div class="sect4">
<h5 id="_description_150">Description</h5>
<div class="paragraph">
<p>Sequence is increasing id used in conjunction with the timestamp to estblish a linear timeline
of log records.  This was added as a workaround for logstores that do not have nano-second precision.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_151">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_4">.pipeline_metadata</h3>
<div class="sect4">
<h5 id="_description_151">Description</h5>
<div class="paragraph">
<p><strong>(DEPRECATED)</strong> <strong>(optional)</strong> Metadata related to ViaQ log collection pipeline. Everything about log collector, normalizers, mappings goes here.
Data in this subgroup is forwarded for troubleshooting and tracing purposes.  This is only present when deploying
fluentd collector implementations</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_152">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">collector</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Collector metadata</p>
</div></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_4">.pipeline_metadata.collector</h3>
<div class="sect4">
<h5 id="_description_152">Description</h5>
<div class="paragraph">
<p>Collector metadata</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_153">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">inputname</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(DEPRECATED)</strong></p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">ipaddr4</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p><strong>(optional)</strong> Ipaddr4 is the ipV4 address of the collector</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">name</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Name is the implementation of the collector agent</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">original_raw_message</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>OriginalRawMessage captures the original message for eventrouter logs</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">received_at</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>ReceivedAt the time the collector received the log entry</p>
</div></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">version</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"><div class="paragraph">
<p>Version is collector version information</p>
</div></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_inputname_4">.pipeline_metadata.collector.inputname</h3>
<div class="sect4">
<h5 id="_description_153">Description</h5>
<div class="paragraph">
<p><strong>(DEPRECATED)</strong></p>
</div>
</div>
<div class="sect4">
<h5 id="_type_154">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_ipaddr4_4">.pipeline_metadata.collector.ipaddr4</h3>
<div class="sect4">
<h5 id="_description_154">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> Ipaddr4 is the ipV4 address of the collector</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_155">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_name_4">.pipeline_metadata.collector.name</h3>
<div class="sect4">
<h5 id="_description_155">Description</h5>
<div class="paragraph">
<p>Name is the implementation of the collector agent</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_156">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_original_raw_message_4">.pipeline_metadata.collector.original_raw_message</h3>
<div class="sect4">
<h5 id="_description_156">Description</h5>
<div class="paragraph">
<p>OriginalRawMessage captures the original message for eventrouter logs</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_157">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_received_at_4">.pipeline_metadata.collector.received_at</h3>
<div class="sect4">
<h5 id="_description_157">Description</h5>
<div class="paragraph">
<p>ReceivedAt the time the collector received the log entry</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_158">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_pipeline_metadata_collector_version_4">.pipeline_metadata.collector.version</h3>
<div class="sect4">
<h5 id="_description_158">Description</h5>
<div class="paragraph">
<p>Version is collector version information</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_159">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_viaq_index_name_4">.viaq_index_name</h3>
<div class="sect4">
<h5 id="_description_159">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> ViaqIndexName used with Elasticsearch 6.x and later, this is a name of a write index alias (e.g. app-write).</p>
</div>
<div class="paragraph">
<p>The value depends on the log type of this message. Detailed documentation is found at <a href="https://github.com/openshift/enhancements/blob/master/enhancements/cluster-logging/cluster-logging-es-rollover-data-design.md#data-model" class="bare">https://github.com/openshift/enhancements/blob/master/enhancements/cluster-logging/cluster-logging-es-rollover-data-design.md#data-model</a>.</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_160">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_viaq_msg_id_4">.viaq_msg_id</h3>
<div class="sect4">
<h5 id="_description_160">Description</h5>
<div class="paragraph">
<p><strong>(optional)</strong> ViaqMessageId is a unique ID assigned to each message. The format is not specified.</p>
</div>
<div class="paragraph">
<p>It may be a UUID or a Base64 (e.g. 82f13a8e-882a-4344-b103-f0a6f30fd218),
or some other ASCII value and is used as the <code>_id</code> of the document when sending to Elasticsearch. The intended use of this field is that if you use another
logging store or application other than Elasticsearch, but you still need to correlate data with the data stored
in Elasticsearch, this field will give you the exact document corresponding to the record.</p>
</div>
<div class="paragraph">
<p>This is only present when deploying fluentd collector implementations</p>
</div>
</div>
<div class="sect4">
<h5 id="_type_161">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_stream_id">._STREAM_ID</h3>
<div class="sect4">
<h5 id="_description_161">Description</h5>

</div>
<div class="sect4">
<h5 id="_type_162">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_systemd_invocation_id">._SYSTEMD_INVOCATION_ID</h3>
<div class="sect4">
<h5 id="_description_162">Description</h5>

</div>
<div class="sect4">
<h5 id="_type_163">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_systemd">.systemd</h3>
<div class="sect4">
<h5 id="_description_163">Description</h5>

</div>
<div class="sect4">
<h5 id="_type_164">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">t</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">u</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">object</p></td>
<td class="tableblock halign-left valign-top"><div class="content"></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_systemd_t">.systemd.t</h3>
<div class="sect4">
<h5 id="_description_164">Description</h5>

</div>
<div class="sect4">
<h5 id="_type_165">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">BOOT_ID</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">CAP_EFFECTIVE</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">CMDLINE</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">COMM</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">EXE</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">GID</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">MACHINE_ID</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">PID</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">SELINUX_CONTEXT</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">STREAM_ID</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">SYSTEMD_CGROUP</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">SYSTEMD_INVOCATION_ID</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">SYSTEMD_SLICE</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">SYSTEMD_UNIT</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">TRANSPORT</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"></div></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">UID</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_systemd_t_boot_id">.systemd.t.BOOT_ID</h3>
<div class="sect4">
<h5 id="_description_165">Description</h5>

</div>
<div class="sect4">
<h5 id="_type_166">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_systemd_t_cap_effective">.systemd.t.CAP_EFFECTIVE</h3>
<div class="sect4">
<h5 id="_description_166">Description</h5>

</div>
<div class="sect4">
<h5 id="_type_167">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_systemd_t_cmdline">.systemd.t.CMDLINE</h3>
<div class="sect4">
<h5 id="_description_167">Description</h5>

</div>
<div class="sect4">
<h5 id="_type_168">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_systemd_t_comm">.systemd.t.COMM</h3>
<div class="sect4">
<h5 id="_description_168">Description</h5>

</div>
<div class="sect4">
<h5 id="_type_169">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_systemd_t_exe">.systemd.t.EXE</h3>
<div class="sect4">
<h5 id="_description_169">Description</h5>

</div>
<div class="sect4">
<h5 id="_type_170">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_systemd_t_gid">.systemd.t.GID</h3>
<div class="sect4">
<h5 id="_description_170">Description</h5>

</div>
<div class="sect4">
<h5 id="_type_171">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_systemd_t_machine_id">.systemd.t.MACHINE_ID</h3>
<div class="sect4">
<h5 id="_description_171">Description</h5>

</div>
<div class="sect4">
<h5 id="_type_172">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_systemd_t_pid">.systemd.t.PID</h3>
<div class="sect4">
<h5 id="_description_172">Description</h5>

</div>
<div class="sect4">
<h5 id="_type_173">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_systemd_t_selinux_context">.systemd.t.SELINUX_CONTEXT</h3>
<div class="sect4">
<h5 id="_description_173">Description</h5>

</div>
<div class="sect4">
<h5 id="_type_174">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_systemd_t_stream_id">.systemd.t.STREAM_ID</h3>
<div class="sect4">
<h5 id="_description_174">Description</h5>

</div>
<div class="sect4">
<h5 id="_type_175">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_systemd_t_systemd_cgroup">.systemd.t.SYSTEMD_CGROUP</h3>
<div class="sect4">
<h5 id="_description_175">Description</h5>

</div>
<div class="sect4">
<h5 id="_type_176">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_systemd_t_systemd_invocation_id">.systemd.t.SYSTEMD_INVOCATION_ID</h3>
<div class="sect4">
<h5 id="_description_176">Description</h5>

</div>
<div class="sect4">
<h5 id="_type_177">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_systemd_t_systemd_slice">.systemd.t.SYSTEMD_SLICE</h3>
<div class="sect4">
<h5 id="_description_177">Description</h5>

</div>
<div class="sect4">
<h5 id="_type_178">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_systemd_t_systemd_unit">.systemd.t.SYSTEMD_UNIT</h3>
<div class="sect4">
<h5 id="_description_178">Description</h5>

</div>
<div class="sect4">
<h5 id="_type_179">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_systemd_t_transport">.systemd.t.TRANSPORT</h3>
<div class="sect4">
<h5 id="_description_179">Description</h5>

</div>
<div class="sect4">
<h5 id="_type_180">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_systemd_t_uid">.systemd.t.UID</h3>
<div class="sect4">
<h5 id="_description_180">Description</h5>

</div>
<div class="sect4">
<h5 id="_type_181">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_systemd_u">.systemd.u</h3>
<div class="sect4">
<h5 id="_description_181">Description</h5>

</div>
<div class="sect4">
<h5 id="_type_182">Type</h5>
<div class="ulist">
<ul>
<li>
<p>object</p>
</li>
</ul>
</div>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<thead>
<tr>
<th class="tableblock halign-left valign-top">Property</th>
<th class="tableblock halign-left valign-top">Type</th>
<th class="tableblock halign-left valign-top">Description</th>
</tr>
</thead>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">SYSLOG_IDENTIFIER</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">string</p></td>
<td class="tableblock halign-left valign-top"><div class="content"></div></td>
</tr>
</tbody>
</table>
</div>
</div>
<div class="sect2">
<h3 id="_systemd_u_syslog_identifier">.systemd.u.SYSLOG_IDENTIFIER</h3>
<div class="sect4">
<h5 id="_description_182">Description</h5>

</div>
<div class="sect4">
<h5 id="_type_183">Type</h5>
<div class="ulist">
<ul>
<li>
<p>string</p>
</li>
</ul>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="footer">
<div id="footer-text">
Last updated 2023-09-01 16:59:03 -0400
</div>
</div>
</body>
</html>